applicationAccessPolicies

App Mailbox Access Policies. Limit which mailboxes a registered app can reach. The applicationAccessPolicies entity set lives under /exchange/v1.0/applicationAccessPolicies in the Roles & access category.

Fact	Value
Path	`/exchange/v1.0/applicationAccessPolicies`
Category	Roles & access
Tier	Tier 5, Compliance
Read role	`Compliance.IPPS.Read.All` (Community)
Write role	none (read-only)
Backing cmdlets	Get-ApplicationAccessPolicy, New-ApplicationAccessPolicy, Remove-ApplicationAccessPolicy

Routes

Method	Path	Synopsis	Role	Plan
GET	`/exchange/v1.0/applicationAccessPolicies`	List applicationAccessPolicies entries.	`Compliance.IPPS.Read`	Community
POST	`/exchange/v1.0/applicationAccessPolicies`	Create a new applicationAccessPolicies entry. Body keys map 1:1 to New-ApplicationAccessPolicy parameter names (camelCased). Required: accessRight (RestrictAccess \| DenyAccess), appId (the Entra app id getting restricted), policyScopeGroupId (the security group whose members the app can access). Returns 201 + Location + the freshly-fetched policy.	`Compliance.IPPS.ReadWrite`	Enterprise
GET	`/exchange/v1.0/applicationAccessPolicies/{key}`	Get a single applicationAccessPolicies entry by Identity.	`Compliance.IPPS.Read`	Community
DELETE	`/exchange/v1.0/applicationAccessPolicies/{key}`	Remove the applicationAccessPolicies at /applicationAccessPolicies/{key}. Returns 204 with no body. NOTE: no PATCH endpoint - Set-ApplicationAccessPolicy doesn’t exist in EXO; to “update” a policy, DELETE + re-POST.	`Compliance.IPPS.ReadWrite`	Enterprise

GET /exchange/v1.0/applicationAccessPolicies

List applicationAccessPolicies entries.

Backing cmdlet: Get-ApplicationAccessPolicy. Role: Compliance.IPPS.Read (Community).

List scoped Graph application access policies

Lists tenant-wide Application Access Policies via Get-ApplicationAccessPolicy. These policies restrict which mailboxes an Entra app registration can access via Microsoft Graph (RestrictAccess scopes the app to a security group; DenyAccess blocks it). Tier 5 IPPS - backed by Compliance.IPPS.Read.All; cmdlet routes through the EXO pool (Wiki applicable: Exchange Online).

GET /exchange/v1.0/applicationAccessPolicies HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "https://api.contoso.com/exchange/v1.0/$metadata#applicationAccessPolicies",
  "value": [
    {
      "Id": "00000000-0000-0000-0000-000000000000\\6c711892-7541-444c-a3f5-3f81714cee3d:S-1-5-21-...;464ad19a-fe67-4f81-a742-e3e914d9b05e",
      "Identity": "00000000-0000-0000-0000-000000000000\\6c711892-7541-444c-a3f5-3f81714cee3d:S-1-5-21-...;464ad19a-fe67-4f81-a742-e3e914d9b05e",
      "AppId": "6c711892-7541-444c-a3f5-3f81714cee3d",
      "Description": "Application access policy restricting third-party migration tool to a specific scope.",
      "AccessRight": "RestrictAccess",
      "ScopeIdentity": "Restricted-Migration-Targets",
      "ShardType": "All",
      "IsValid": true
    }
  ]
}

POST /exchange/v1.0/applicationAccessPolicies

Create a new applicationAccessPolicies entry. Body keys map 1:1 to New-ApplicationAccessPolicy parameter names (camelCased). Required: accessRight (RestrictAccess | DenyAccess), appId (the Entra app id getting restricted), policyScopeGroupId (the security group whose members the app can access). Returns 201 + Location + the freshly-fetched policy.

Creates a policy that restricts an Entra app registration’s Microsoft Graph mailbox access. accessRight: “RestrictAccess” limits the app to members of policyScopeGroupId; “DenyAccess” blocks the app from members of the group. policyScopeGroupId MUST be a mail-enabled security group or M365 group - regular distribution groups are rejected with “identity of the policy scope is not a security principal”.EXO-side (despite the IPPS auth scope) - Wiki applicable: Exchange Online - so the dispatcher routes this through the EXO pool. Note: no PATCH endpoint exists (Set-ApplicationAccessPolicy is not in EXO); to “update” a policy, callers DELETE + re-POST.

Backing cmdlet: New-ApplicationAccessPolicy. Role: Compliance.IPPS.ReadWrite (Enterprise).

Parameter	In	Type	Required
`accessRight`	body		yes
`appId`	body		yes
`policyScopeGroupId`	body		yes
`description`	body
`dryRun`	query	bool (switch)

Create a scoped Graph application access policy

Create an Application Access Policy via New-ApplicationAccessPolicy. This restricts which mailboxes an Entra app registration can access through Microsoft Graph - RestrictAccess limits the app to a security group’s members, DenyAccess blocks the app from members of the group. Required: accessRight, appId (list - usually one), policyScopeGroupId (a MAIL-ENABLED security group or M365 group - regular DGs are rejected with “identity of the policy scope is not a security principal”). Note: there is no Set-ApplicationAccessPolicy in EXO; to “update” a policy, DELETE + re-POST. Routes through the EXO pool (Wiki applicable: Exchange Online).

POST /exchange/v1.0/applicationAccessPolicies HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "accessRight": "RestrictAccess",
  "appId": [
    "6c711892-7541-444c-a3f5-3f81714cee3d"
  ],
  "policyScopeGroupId": "migration-targets@contoso.com",
  "description": "Restrict the third-party migration tool to the migration-targets security group."
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/applicationAccessPolicies/{generated-identity}

{
  "@odata.context": "https://api.contoso.com/exchange/v1.0/$metadata#applicationAccessPolicies/$entity",
  "Id": "00000000-0000-0000-0000-000000000000\\6c711892-7541-444c-a3f5-3f81714cee3d:S-1-5-21-...",
  "Identity": "00000000-0000-0000-0000-000000000000\\6c711892-7541-444c-a3f5-3f81714cee3d:S-1-5-21-...",
  "AppId": "6c711892-7541-444c-a3f5-3f81714cee3d",
  "Description": "Restrict the third-party migration tool to the migration-targets security group.",
  "AccessRight": "RestrictAccess",
  "ScopeIdentity": "migration-targets",
  "ShardType": "All",
  "IsValid": true
}

GET /exchange/v1.0/applicationAccessPolicies/{key}

Get a single applicationAccessPolicies entry by Identity.

Backing cmdlet: Get-ApplicationAccessPolicy. Role: Compliance.IPPS.Read (Community).

Get an application access policy by key

Returns a single scoped Microsoft Graph application access policy by its composite Identity, including the restricted app id, access right, and the security group scope it applies to.

GET /exchange/v1.0/applicationAccessPolicies/{key} HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#applicationAccessPolicies/$entity",
  "Id": "00000000-0000-0000-0000-000000000000\\a1b2c3d4-1111-2222-3333-444455556666:S-1-5-21-1000000001-1000000002-1000000003-1000000004;b7e9d2f0-5a3c-4e8b-9c1d-2f6a8b0e1234",
  "Identity": "00000000-0000-0000-0000-000000000000\\a1b2c3d4-1111-2222-3333-444455556666:S-1-5-21-1000000001-1000000002-1000000003-1000000004;b7e9d2f0-5a3c-4e8b-9c1d-2f6a8b0e1234",
  "AppId": "a1b2c3d4-1111-2222-3333-444455556666",
  "Description": "Application access policy restricting the migration tool Azure app registration to just the Exchange mailboxes in-scope",
  "AccessRight": "RestrictAccess",
  "PolicyScopeGroupId": null,
  "ScopeIdentity": "",
  "ScopeName": "S-1-5-21-1000000001-1000000002-1000000003-1000000004;b7e9d2f0-5a3c-4e8b-9c1d-2f6a8b0e1234",
  "ScopeIdentityRaw": "S-1-5-21-1000000001-1000000002-1000000003-1000000004;b7e9d2f0-5a3c-4e8b-9c1d-2f6a8b0e1234",
  "ShardType": "All",
  "IsValid": true
}

DELETE /exchange/v1.0/applicationAccessPolicies/{key}

Remove the applicationAccessPolicies at /applicationAccessPolicies/{key}. Returns 204 with no body. NOTE: no PATCH endpoint - Set-ApplicationAccessPolicy doesn’t exist in EXO; to “update” a policy, DELETE + re-POST.

Removes the scoped application access policy and immediately restores the app’s default Graph mailbox access (i.e. tenant-wide, subject to the app’s granted scopes). {key} is the composite Identity (typically “<tenantGuid><appId>:<SID>”); for callers that only have the appId, list policies first and copy the Identity from the response.EXO-side. The cmdlet accepts -Confirm normally, so the controller does NOT pass omitConfirm here. Pass ?dryRun=true to map to -WhatIf.

Backing cmdlet: Remove-ApplicationAccessPolicy. Role: Compliance.IPPS.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
`dryRun`	query	bool (switch)

Delete an application access policy

Removes the scoped application access policy via Remove-ApplicationAccessPolicy, restoring the app’s default tenant-wide Graph mailbox access. There is no Set-ApplicationAccessPolicy in EXO, so updates are done by DELETE + re-POST.

DELETE /exchange/v1.0/applicationAccessPolicies/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

?dryRun=true previews of any write stay on Community.