[Python] Azure ApplicationAccessPolicy not blocking access for certain users in Microsoft...

I am using an ApplicationAccessPolicy in Exchange Online to restrict an Azure AD application’s access to only one specific mailbox (my personal account). The goal is for the application to only access the mailbox of the user "famas@example.com", and block access to all other mailboxes.

I created the policy with the following PowerShell command:

New-ApplicationAccessPolicy `
-AppId "00000000-0000-0000-0000-000000000000" `
-PolicyScopeGroupId "famas@example.com" `
-AccessRight RestrictAccess `
-Description "Restrict app access to only Famas’s mailbox"


I then tested the policy with:

Test-ApplicationAccessPolicy `
-Identity "famas@example.com" `
-AppId "00000000-0000-0000-0000-000000000000"


It returns:

AccessCheckResult : Granted


However, when testing with other users (user1@example.com, user2@example.com), these commands:

Test-ApplicationAccessPolicy `
-Identity "user1@example.com" `
-AppId "00000000-0000-0000-0000-000000000000"


and

Test-ApplicationAccessPolicy `
-Identity "user2@example.com" `
-AppId "00000000-0000-0000-0000-000000000000"


return:

AccessCheckResult : Denied

Technical context


The application uses an OAuth2 client credentials flow token (application permission) via the MSAL Python library. Here is a simplified code snippet to retrieve emails via Microsoft Graph API:

from msal import ConfidentialClientApplication
import requests

config = {
"application_id": "00000000-0000-0000-0000-000000000000",
"application_secret": "your_secret",
"tenant_id": "your_tenant_id",
"user_email": "user2@example.com"
}

app = ConfidentialClientApplication(
config["application_id"],
authority=f"https://login.microsoftonline.com/{config['tenant_id']}",
client_credential=config["application_secret"]
)

result = app.acquire_token_for_client(scopes=["https://graph.microsoft.com/.default"])

if "access_token" in result:
headers = {
"Authorization": f"Bearer {result['access_token']}",
"ConsistencyLevel": "eventual"
}

endpoint = f"https://graph.microsoft.com/v1.0/users/{config['user_email']}/mailFolders/inbox/messages?$top=10&$select=subject,receivedDateTime,from,body"

response = requests.get(endpoint, headers=headers)

if response.status_code == 200:
data = response.json()
mails = data.get("value", [])
for mail in mails:
print(mail["subject"])
else:
print("Error accessing mail:", response.status_code, response.text)
else:
print("Authentication failed:", result.get("error_description"))

Questions

1. Why does the ApplicationAccessPolicy seem not to apply consistently to all users?
2. How can I ensure access is strictly limited to a single user with ApplicationAccessPolicy?
3. Are there additional Azure AD configurations required to enforce this restriction?
4. Does the application need to use only Application permissions (not Delegated) for the policy to be effective?

Thanks in advance for your help!

Continue reading...