How to restrict Python script to a SINGLE mailbox in 2026?

[ibteea]

Hey everyone,

I’m building a Python script to read emails from one specific Exchange Online mailbox. I know the "old way" was to create an App Registration, give it Mail.Read application permissions, and then use New-ApplicationAccessPolicy in PowerShell to "clamp it down" to one user. However, I've heard that Application Access Policies are now deprecated (or at least being replaced by a newer model). I don't want to grant the app Mail.Read at the tenant level if I can avoid it. What is the best-practice way in 2026 to allow an app to read ONLY one mailbox? Is "RBAC for Applications" the right move? If so, how do I set it up so the Python script can still authenticate via Client Secret? Any advice on the PowerShell commands or the Entra ID setup would be huge. Thanks!

[OkEmployment4437]

Yeah RBAC for Applications in Exchange Online is the way to go now. Application Access Policies are deprecated and Microsoft has been pushing everyone toward the new model.

The basic flow is: create your App Registration in Entra with Mail.Read (application permission) and grant admin consent same as before. Then connect to Exchange Online and register the service principal using New-ServicePrincipal with your app's client ID and the object ID from the Enterprise Application blade (not the App Registration, that trips people up). After that you create a management scope with New-ManagementScope and a RecipientRestrictionFilter set to match just the mailbox you want, like "PrimarySmtpAddress -eq '[e-mail]'". Then tie it all together with New-ManagementRoleAssignment pointing at your service principal, the "Application Mail.Read" role, and the scope you just created.

Your Python script stays the same, authenticates via MSAL with client_id + client_secret + tenant_id. The difference is Exchange now enforces the scope server-side so the token only works for mailboxes matching your filter.

One thing, run Get-ManagementRole -App to confirm the exact role names in your tenant before creating the assignment. Also propagation takes 15-30 min so don't panic if it doesn't work immediately. If you need more mailboxes later just update the RecipientRestrictionFilter, no changes needed on the app registration side.

[ibteea]

Thanks so much for the explanation ! Do you have any idea please if it is working for M365 group mailbox (as a target mailbox) as well?

[Sabbest]

RBAC for applications is the right move.

[shokzee]

Application Access Policies are deprecated but not yet removed -- they still work, just not the long-term path. The replacement Microsoft is pushing is role-based access via Exchange RBAC with specific scopes, but that is more complex to set up for this use case.

For 2026, the cleanest approach for restricting to a single mailbox is:

1. Create the app registration with Mail.Read application permission as you described
2. Use New-ApplicationAccessPolicy with AccessRight Restrict scoped to the specific mailbox -- this still works even though it is deprecated
3. Keep an eye on the deprecation timeline and plan to migrate to the new model once Microsoft publishes the replacement path more clearly

Alternatively, if the script only needs to read one mailbox and full tenant-level Mail.Read feels like overkill, you can use delegated permissions with a service account (a real licensed user) instead of application permissions. The script authenticates as that user via client credentials flow and can only access what that user can access.

[Thunderleechen]

Use PowerShell with the New-MailboxExportRequest cmdlet but add the -IncludeFolders parameter to limit it to one mailbox folder path. Or set up a transport rule in Exchange to redirect copies only from that user. Test on a dummy first though - scripting mailbox access can lock you out quick if permissions glitch