Limit mailbox access

Admin

Limit which mailboxes the Hyperfox app can reach when your IT policy allows it to reach only the order mailboxes: by default, the permissions your Microsoft 365 administrator accepts in Connect your Microsoft 365 organisation apply to every mailbox in your organisation. Watched mailboxes decides which mailboxes Hyperfox reads; an application access policy in Exchange Online decides which mailboxes Microsoft lets the app reach at all. You set the policy up in your own Microsoft 365 organisation: Hyperfox cannot grant itself access.

The policy limits Mail.ReadWrite and MailboxSettings.ReadWrite. Organization.Read.All reads directory data, not mailbox content, and stays as it is.

Before you begin

You have the Exchange Administrator or Global Administrator role in Microsoft 365.

The Exchange Online PowerShell module is installed:

Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser

You have the application (client) ID of Hyperfox. It is the same ID as on the consent screen and under Enterprise applications in Microsoft Entra:
```
2e613e2d-39ea-40e0-9036-1f79b039aa1e
```

Create a group with the order mailboxes

Connect to Exchange Online:

Connect-ExchangeOnline -UserPrincipalName [email protected]

Create a mail-enabled security group with only the mailboxes Hyperfox may reach. Pass one address, or several separated by commas:
```
New-DistributionGroup `
  -Name "Hyperfox Scoped Mailboxes" `
  -Alias hyperfox-scoped `
  -Type Security `
  -Members [email protected], [email protected]
```
Keep this group for Hyperfox only: every mailbox in it becomes reachable by the app.

Restrict the app to the group

Create an application access policy with RestrictAccess:

New-ApplicationAccessPolicy `
  -AppId 2e613e2d-39ea-40e0-9036-1f79b039aa1e `
  -PolicyScopeGroupId [email protected] `
  -AccessRight RestrictAccess `
  -Description "Restrict Hyperfox to the order mailboxes"

RestrictAccess lets the app reach only the members of the group. Do not use DenyAccess: it blocks the members and leaves every other mailbox open.

Wait up to 30 minutes. Exchange Online can take that long to apply the policy.

Check the restriction

Test every mailbox in the group:

Test-ApplicationAccessPolicy -AppId 2e613e2d-39ea-40e0-9036-1f79b039aa1e -Identity [email protected]

The result is AccessCheckResult: Granted.

Test a mailbox outside the group:

Test-ApplicationAccessPolicy -AppId 2e613e2d-39ea-40e0-9036-1f79b039aa1e -Identity [email protected]

The result is AccessCheckResult: Denied.

When an order mailbox shows Denied, check that it is a member of the group. When another mailbox shows Granted, wait for the policy to apply and test again. Get-ApplicationAccessPolicy lists the policy.

In Hyperfox, every mailbox under Watched mailboxes still shows Active.

Add or remove an order mailbox later

Change the group, not the policy:

Add-DistributionGroupMember    -Identity [email protected] -Member [email protected]
Remove-DistributionGroupMember -Identity [email protected] -Member [email protected]

Add a new mailbox to the group before you add it under Watched mailboxes. Hyperfox cannot save a mailbox outside the group.

Remove the access of the Hyperfox app

To remove the access of the Hyperfox app in Microsoft 365 entirely, open Enterprise applications in the Microsoft Entra admin center and the Hyperfox app. Remove the granted permissions under Permissions, or delete the app under Properties. In Hyperfox, click Disconnect on the Outlook channel as well.

Before you begin​

Create a group with the order mailboxes​

Restrict the app to the group​

Check the restriction​

Add or remove an order mailbox later​

Remove the access of the Hyperfox app​

See also​