> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enterprise.emailmeter.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Restrict access in Microsoft 365

> Restrict Email Meter access to specific mailboxes only

<img style={{ borderRadius: '0.5rem' }} src="https://storage.googleapis.com/em-docs/enterprise-documentation/images/restrict-microsoft.webp" />

As an administrator, you can limit Email Meter's access to a specific group of mailboxes rather than your entire organization. In Microsoft 365, this is done in two steps: creating a mail-enabled security group with the mailboxes you want to track, and creating an ApplicationAccessPolicy in Exchange Online that restricts Email Meter to that group.

<Info>Microsoft 365 doesn't offer this option during installation. You set it up afterwards, at any time: right after granting admin consent, or once Email Meter is already up and running.</Info>

## Create a mail-enabled security group

Log into your Microsoft 365 admin portal and go to `Groups > Active`.

<img style={{ borderRadius: '0.5rem' }} src="https://storage.googleapis.com/em-docs/enterprise-documentation/images/restrictmicrosoft--001.webp" />

Choose `Mail-enabled security` on the secondary navigation menu.

<img style={{ borderRadius: '0.5rem' }} src="https://storage.googleapis.com/em-docs/enterprise-documentation/images/restrictmicrosoft--002.webp" />

Click on `Add a group` to create a new group.

<img style={{ borderRadius: '0.5rem' }} src="https://storage.googleapis.com/em-docs/enterprise-documentation/images/restrictmicrosoft--003.webp" />

On the following screen, select `Mail-enabled security group`. Then, choose a name, owners and members.

<img style={{ borderRadius: '0.5rem' }} src="https://storage.googleapis.com/em-docs/enterprise-documentation/images/restrictmicrosoft--004.webp" />

Once created, click into the group and open `Members` to choose the mailboxes you want to include. Those will be the only mailboxes that Email Meter will be able to get data from.

<img style={{ borderRadius: '0.5rem' }} src="https://storage.googleapis.com/em-docs/enterprise-documentation/images/restrictmicrosoft--005.webp" />

## Create an ApplicationAccessPolicy

Now you’ll need to create an ApplicationAccessPolicy to limit Email Meter's access to the mailboxes you’ve added to the Mail-enabled security group.

<Info>This step can only be done through Exchange Online PowerShell: Microsoft doesn't offer a way to create application access policies from the admin center. For detailed instructions on connecting to Exchange Online PowerShell, please read Microsoft's documentation [here](https://learn.microsoft.com/en-us/powershell/exchange/exchange-online/connect-to-exchange-online-powershell/connect-to-exchange-online-powershell?view=exchange-ps\&preserve-view=true).</Info>

In PowerShell, run the following command, replacing the arguments for PolicyScopeGroupId, and Description.

```powershell theme={null}
New-ApplicationAccessPolicy -AppId ded01d8e-6870-47b2-8d53-0278cf850df1 -PolicyScopeGroupId securitygroup@yourcompany.com -AccessRight RestrictAccess -Description "Restrict this app to members of the Mail-enabled security group."
```

## Test the restriction

Once this is done, you can test that the policy is restricting access by running a PowerShell command. Just replace the argument for Identity:

```powershell theme={null}
Test-ApplicationAccessPolicy -Identity exampleuser@yourcompany.com -AppId ded01d8e-6870-47b2-8d53-0278cf850df1
```

The `AccessCheckResult` field in the output tells you whether Email Meter can access that mailbox: `Granted` means it can, `Denied` means it can't. Test with a mailbox that is **not** a member of the security group. If the result is `Denied`, the restriction is working. If it's `Granted`, double check that the policy points to the right group and that the group is of the Mail-enabled security type.

<Warning>Changes to application access policies can take longer than 1 hour to take effect in Microsoft Graph REST API calls, even when Test-ApplicationAccessPolicy shows positive results.</Warning>

## What to expect in Email Meter

Once the policy is in effect:

* **Adding mailboxes**: when you try to add a mailbox that isn't a member of the security group, the mailbox check will fail with the message "Email Meter can't access this mailbox".
* **Mailboxes added before the policy**: if a mailbox that isn't in the group was added to your dashboard before the policy took effect, it will stop receiving new data and show a sync error. Add it to the security group, or remove it from your dashboard.

## Frequently asked questions

<AccordionGroup>
  <Accordion title="Do I need to grant access to everyone using Email Meter?">
    No, it's not necessary to grant access to all users who access Email Meter. Email Meter requires access only to the mailboxes that are being tracked: this means that only the accounts for which you want to generate email statistics need to be granted access.
  </Accordion>

  <Accordion title="Can I set this up after installing Email Meter?">
    Yes. In Microsoft 365 this is the only way: the restriction is always configured after admin consent has been granted. Keep in mind that any mailbox already being tracked that isn't a member of the security group will stop syncing once the policy applies.
  </Accordion>

  <Accordion title="How do I change which mailboxes Email Meter can access?">
    Just add or remove members from the Mail-enabled security group. You don't need to change the policy: it always applies to the current members of the group. Remember that changes can take longer than 1 hour to take effect.

    If you want to point the policy to a different group, remove it and create a new one:

    ```powershell theme={null}
    Get-ApplicationAccessPolicy
    Remove-ApplicationAccessPolicy -Identity "Identity value from the previous command"
    ```
  </Accordion>

  <Accordion title="I created the policy, but Email Meter can still access mailboxes outside the group">
    The most common cause is propagation time: changes to application access policies can take longer than 1 hour to reach Microsoft Graph, even when `Test-ApplicationAccessPolicy` already shows the expected results. If it still happens after that, check the following:

    * **Test the right mailbox**: run `Test-ApplicationAccessPolicy` against a mailbox that is not in the group. The result should be `Denied`. If it's `Granted`, the policy isn't restricting anything yet.
    * **Check the group type**: the policy only works with Mail-enabled security groups. Distribution lists and Microsoft 365 groups won't work.
    * **Check for other policies**: if any other RestrictAccess policy for Email Meter includes the mailbox, access is granted. Run `Get-ApplicationAccessPolicy` to review existing policies and remove the ones you don't want.
  </Accordion>

  <Accordion title="Can I include shared mailboxes?">
    Yes. Shared mailboxes can't be used directly as the policy scope, but you can add them as members of the Mail-enabled security group and they'll be covered by the policy like any other member.
  </Accordion>

  <Accordion title="What happens if I remove a mailbox from the security group?">
    Email Meter will lose access to the mailbox and will no longer be able to gather email statistics from it. In your dashboard, the mailbox will show a sync error until you add it back to the group or remove it from tracking.
  </Accordion>

  <Accordion title="Can I use RBAC for Applications instead of an ApplicationAccessPolicy?">
    Yes. Microsoft is replacing Application Access Policies with [Role Based Access Control for Applications](https://learn.microsoft.com/en-us/exchange/permissions-exo/application-rbac), also configured through Exchange Online PowerShell only. Existing policies keep working and Microsoft hasn't announced a deprecation date, so the steps on this page remain valid.

    If your organization prefers RBAC for Applications, keep in mind that permissions from both systems are additive: for the resource scope to take effect, the tenant-wide permission granted during installation must be removed in Microsoft Entra ID. Reach out to us before making this change so we can make sure your mailboxes keep syncing.
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.