MT.1058: Exchange application access policies must be configured.


ID	`MT.1058`
Severity	Medium
Suite	Mito
Product	Entra ID
Related products	Exchange Online
Feature	App consent and permissions
Security area	Applications and workload identities
Resource type	ServicePrincipal
User impact of fixing	Low
Effort to fix	Medium
Framework controls	`nist-800-53-r5:AC-6` Least Privilege `nist-800-53-r5:AC-3` Access Enforcement
MITRE ATT&CK	T1114.002
Reads from	Microsoft Graph, Exchange Online

What this checks and how to fix it

Application access policies in Exchange Online help you control which applications can access which mailboxes.

Without these policies, applications with Exchange permissions can access all mailboxes in your organization.

Microsoft Exchange related permissions that should be secured by application access policies include:

Mail.Read
Mail.ReadBasic
Mail.ReadBasic.All
Mail.ReadWrite
Mail.Send
MailboxSettings.Read
MailboxSettings.ReadWrite
Calendars.Read
Calendars.ReadWrite
Contacts.Read
Contacts.ReadWrite

Exchange application access policies should be configured for all applications with Exchange permissions.

Remediation action

Follow the steps below to create an application access policy in Exchange Online that restricts the application’s access to mailboxes in a specific distribution group.

Connect to Exchange Online

Connect-ExchangeOnline

Define variables for your application

# Get these values from your Application Registration
$AppID = "<your-app-id>"  # e.g. "0a3ad682-b031-416d-86c2-bf263f8b46a3"
$GroupName = "AAP_$AppID"  # example naming convention for clarity
$Description = "Restrict this app to members of distribution group"

Create a mail-enabled security group for policy scope

# Create group and hide from address list
$DGroup = New-DistributionGroup -Name $GroupName -Type Security
Start-Sleep -Seconds 5  # Wait for group creation to propagate
Set-DistributionGroup -Identity $DGroup.WindowsEmailAddress -HiddenFromAddressListsEnabled $true

Create the application access policy

New-ApplicationAccessPolicy -AppId $AppID `
                          -PolicyScopeGroupId $DGroup.WindowsEmailAddress `
                          -AccessRight RestrictAccess `
                          -Description $Description

Add members to the security group

Add-DistributionGroupMember -Identity $GroupName -Member user@contoso.com

Verify the policy

# List all policies
Get-ApplicationAccessPolicy

# Test for specific user
Test-ApplicationAccessPolicy -Identity user@contoso.com -AppId $AppID

Mito check. Author: l-gosling; contributors: merill, SamErde, thomas-s-schmidt. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).