Mailbox-reading Apps Not Scoped to Specific Mailboxes

The question it answers: Which apps with mailbox application permissions can read every mailbox because Exchange does not scope them?

Any app holding a Mail, Calendars, Contacts or MailboxSettings application permission - or Exchange’s full_access_as_app - can read every mailbox, including the CEO’s and HR’s, unless Exchange limits it. This report shows each such app and whether anything does.

Note

An Entra application permission such as Mail.Read is tenant-wide. RBAC for Applications only helps once the Entra grant is removed; an Application Access Policy narrows the Entra grant but is being replaced by RBAC for Applications.

At a glance

Where in the app	Exchange Online › Mail Security & Hygiene › Mailbox-reading Apps Not Scoped
Workload	Exchange Online
Kind	Findings list · dashboard tile
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	No extra licence needed.
Report id (API and MCP)	exchange.hygiene.mailbox-app-scoping

Columns

Column	Key	Type
Severity	Severity	Status
App type	Category	Text
App	Subject	Link
Check	Setting	Text
Permissions	Value	Text
Finding	Finding	Text
Mailboxes it can reach	Detail	Text
First granted	When	Date
Count	Number	Number

A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).

What it needs

Licence: No extra licence needed.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Application.Read.All	Microsoft Graph	Read all applications
Exchange.ManageAsApp	Office 365 Exchange Online	Manage Exchange As Application	+ View-Only Organization Management

Data sources it reads

• GET /v1.0/servicePrincipals/{Graph, Exchange Online}/appRoleAssignedTo
• Get-ApplicationAccessPolicy
• Get-ManagementRoleAssignment -RoleAssigneeType ServicePrincipal
• Get-ServicePrincipal (Exchange)

Through the API and MCP

GET /ir-api/v1/reports/exchange.hygiene.mailbox-app-scoping?size=100

An AI assistant reads it with the MCP tool get_report and the id exchange.hygiene.mailbox-app-scoping. The client needs the Read grant for Exchange Online. See Using the API.