Skip to main content
As an administrator, you can limit Email Meter’s access to a specific group of mailboxes rather than your entire organization. In Microsoft 365, this is done in two steps: creating a mail-enabled security group with the mailboxes you want to track, and creating an ApplicationAccessPolicy in Exchange Online that restricts Email Meter to that group.
Microsoft 365 doesn’t offer this option during installation. You set it up afterwards, at any time: right after granting admin consent, or once Email Meter is already up and running.

​
Create a mail-enabled security group

Log into your Microsoft 365 admin portal and go to Groups > Active. Choose Mail-enabled security on the secondary navigation menu. Click on Add a group to create a new group. On the following screen, select Mail-enabled security group. Then, choose a name, owners and members. Once created, click into the group and open Members to choose the mailboxes you want to include. Those will be the only mailboxes that Email Meter will be able to get data from.

​
Create an ApplicationAccessPolicy

Now you’ll need to create an ApplicationAccessPolicy to limit Email Meter’s access to the mailboxes you’ve added to the Mail-enabled security group.
This step can only be done through Exchange Online PowerShell: Microsoft doesn’t offer a way to create application access policies from the admin center. For detailed instructions on connecting to Exchange Online PowerShell, please read Microsoft’s documentation here.
In PowerShell, run the following command, replacing the arguments for PolicyScopeGroupId, and Description.

​
Test the restriction

Once this is done, you can test that the policy is restricting access by running a PowerShell command. Just replace the argument for Identity:
The AccessCheckResult field in the output tells you whether Email Meter can access that mailbox: Granted means it can, Denied means it can’t. Test with a mailbox that is not a member of the security group. If the result is Denied, the restriction is working. If it’s Granted, double check that the policy points to the right group and that the group is of the Mail-enabled security type.
Changes to application access policies can take longer than 1 hour to take effect in Microsoft Graph REST API calls, even when Test-ApplicationAccessPolicy shows positive results.

​
What to expect in Email Meter

Once the policy is in effect:
  • Adding mailboxes: when you try to add a mailbox that isn’t a member of the security group, the mailbox check will fail with the message “Email Meter can’t access this mailbox”.
  • Mailboxes added before the policy: if a mailbox that isn’t in the group was added to your dashboard before the policy took effect, it will stop receiving new data and show a sync error. Add it to the security group, or remove it from your dashboard.

​
Frequently asked questions

No, it’s not necessary to grant access to all users who access Email Meter. Email Meter requires access only to the mailboxes that are being tracked: this means that only the accounts for which you want to generate email statistics need to be granted access.
Yes. In Microsoft 365 this is the only way: the restriction is always configured after admin consent has been granted. Keep in mind that any mailbox already being tracked that isn’t a member of the security group will stop syncing once the policy applies.
Just add or remove members from the Mail-enabled security group. You don’t need to change the policy: it always applies to the current members of the group. Remember that changes can take longer than 1 hour to take effect.If you want to point the policy to a different group, remove it and create a new one:
The most common cause is propagation time: changes to application access policies can take longer than 1 hour to reach Microsoft Graph, even when Test-ApplicationAccessPolicy already shows the expected results. If it still happens after that, check the following:
  • Test the right mailbox: run Test-ApplicationAccessPolicy against a mailbox that is not in the group. The result should be Denied. If it’s Granted, the policy isn’t restricting anything yet.
  • Check the group type: the policy only works with Mail-enabled security groups. Distribution lists and Microsoft 365 groups won’t work.
  • Check for other policies: if any other RestrictAccess policy for Email Meter includes the mailbox, access is granted. Run Get-ApplicationAccessPolicy to review existing policies and remove the ones you don’t want.
Yes. Shared mailboxes can’t be used directly as the policy scope, but you can add them as members of the Mail-enabled security group and they’ll be covered by the policy like any other member.
Email Meter will lose access to the mailbox and will no longer be able to gather email statistics from it. In your dashboard, the mailbox will show a sync error until you add it back to the group or remove it from tracking.
Yes. Microsoft is replacing Application Access Policies with Role Based Access Control for Applications, also configured through Exchange Online PowerShell only. Existing policies keep working and Microsoft hasn’t announced a deprecation date, so the steps on this page remain valid.If your organization prefers RBAC for Applications, keep in mind that permissions from both systems are additive: for the resource scope to take effect, the tenant-wide permission granted during installation must be removed in Microsoft Entra ID. Reach out to us before making this change so we can make sure your mailboxes keep syncing.