{"id":5926,"date":"2021-02-05T14:39:56","date_gmt":"2021-02-05T22:39:56","guid":{"rendered":"https:\/\/officedevblogs.wpengine.com\/?p=5926"},"modified":"2021-11-17T12:40:35","modified_gmt":"2021-11-17T20:40:35","slug":"application-access-policy-support-added-to-exchange-web-services","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/application-access-policy-support-added-to-exchange-web-services\/","title":{"rendered":"Application Access Policy Support Added to Exchange Web Services in Exchange Online"},"content":{"rendered":"<p><span data-contrast=\"none\">The Application Access Policy feature enables an administrator to enforce access control to an AppOnly app to a specific set of mailboxes. We previously introduced Application Access Policy support for Microsoft Graph, and we are now adding Application Access Policy support to Exchange Web Services (EWS) in Exchange Online, in response to customer feedback and as a mechanism to ease transition from EWS to Microsoft Graph.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<h4><span data-contrast=\"none\">Background<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559738&quot;:40,&quot;335559739&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">Some apps call EWS using their own identity and not on behalf of a user. These are usually background services or daemon apps that run on a server without the presence of a signed-in user. These apps make use of OAuth 2.0 client credentials grant flow to authenticate and are configured with application permissions (or\u00a0AppOnly\u00a0permissions). EWS supports\u00a0AppOnly\u00a0access via \u201cfull_access_as_app\u201d scope. This scope enables a client application with EWS access to impersonate\u00a0all\u00a0the\u00a0mailboxes within a customer\u2019s organization.\u00a0Without this new feature, administrators do not have a way to scope the EWS\u00a0AppOnly\u00a0application\u2019s impersonation access to a specific set of mailboxes.\u00a0Providing the ability to have more fine-grained EWS\u00a0permission\u00a0scopes\u00a0is a common request that we\u2019ve heard from our EWS partners.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<h4><span data-contrast=\"none\">Application Access Policy<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559738&quot;:40,&quot;335559739&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">With\u00a0support for\u00a0Application Access\u00a0Policies\u00a0in EWS,\u00a0administrators\u00a0can\u00a0now limit an\u00a0AppOnly\u00a0app\u2019s access\u00a0to a specific set of mailboxes by specifying an inclusion or exclusion list.<\/span><span data-contrast=\"none\">\u00a0Administrators who want to limit the 3<\/span><span data-contrast=\"none\">rd<\/span><span data-contrast=\"none\">\u00a0party app access to a specific set of mailboxes can use the Application Access Policy PowerShell cmdlets to configure access control.\u00a0The following pages describe the functionality of Application\u00a0Access\u00a0Policy feature in detail.\u00a0<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"3\" data-aria-posinset=\"1\" data-aria-level=\"1\"><a href=\"https:\/\/docs.microsoft.com\/graph\/auth-limit-mailbox-access\"><span data-contrast=\"none\">Scoping application permissions to specific Exchange Online mailboxes<\/span><\/a><span data-ccp-props=\"{&quot;134233279&quot;:true,&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/li>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"3\" data-aria-posinset=\"2\" data-aria-level=\"1\"><a href=\"https:\/\/docs.microsoft.com\/powershell\/module\/exchange\/organization\/new-applicationaccesspolicy?view=exchange-ps\"><span data-contrast=\"none\">New-ApplicationAccessPolicy<\/span><\/a><span data-ccp-props=\"{&quot;134233279&quot;:true,&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/li>\n<\/ul>\n<h4><span data-contrast=\"none\">No\u00a0(Other) New\u00a0Investments\u00a0in EWS<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559738&quot;:40,&quot;335559739&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/h4>\n<p><a href=\"https:\/\/techcommunity.microsoft.com\/t5\/exchange-team-blog\/upcoming-changes-to-exchange-web-services-ews-api-for-office-365\/ba-p\/608055\"><span data-contrast=\"none\">We\u00a0announced<\/span><\/a><span data-contrast=\"none\">\u00a0in 2018\u00a0that there\u00a0wouldn\u2019t\u00a0be any new feature updates to EWS.\u00a0We added this\u00a0support\u00a0to\u00a0address\u00a0customer\u00a0security\u00a0concerns.\u00a0<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">As there are no new feature investments in EWS, we strongly\u00a0<\/span><span data-contrast=\"none\">suggest migrating to Microsoft Graph to access Exchange Online data and gain access to the latest features and functionality. For more information and details on how to make the transition, please refer to the following articles:\u00a0<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"2\" data-aria-posinset=\"1\" data-aria-level=\"1\"><a href=\"https:\/\/developer.microsoft.com\/graph\/docs\/concepts\/overview\"><span data-contrast=\"none\">Overview of Microsoft Graph<\/span><\/a><span data-contrast=\"none\">\u00a0<\/span><span data-ccp-props=\"{&quot;134233279&quot;:true,&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/li>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"2\" data-aria-posinset=\"2\" data-aria-level=\"1\"><a href=\"https:\/\/developer.microsoft.com\/graph\/docs\/concepts\/outlook-mail-concept-overview\"><span data-contrast=\"none\">Overview of Outlook mail API on Microsoft Graph<\/span><\/a><span data-ccp-props=\"{&quot;134233279&quot;:true,&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"none\">While EWS and\u00a0Microsoft\u00a0Graph have mostly overlapping functionality, there are some differences. If you rely on an EWS API that does not have a\u00a0Microsoft\u00a0Graph counterpart, please let us know via\u00a0<\/span><a href=\"https:\/\/officespdev.uservoice.com\/\"><span data-contrast=\"none\">UserVoice<\/span><\/a><span data-contrast=\"none\">\u00a0of features needed for your app scenarios.\u00a0\u00a0<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<h4><span data-contrast=\"none\">Basic Authentication<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559738&quot;:40,&quot;335559739&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">This is also a good time to remind everyone that\u00a0we\u00a0are\u00a0<\/span><a href=\"https:\/\/techcommunity.microsoft.com\/t5\/exchange-team-blog\/basic-authentication-and-exchange-online-july-update\/ba-p\/1530163\"><span data-contrast=\"none\">retiring Basic Authentication\u00a0in Exchange Online<\/span><\/a><span data-contrast=\"none\">;\u00a0if\u00a0you are using EWS\u00a0or any other email access protocol like POP, IMAP\u00a0or\u00a0EAS in combination with Basic Auth, you need to make sure you are using OAuth and not Basic Authentication.\u00a0Furthermore, we strongly recommend that you modernize your\u00a0apps and\u00a0move to Microsoft Graph.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<h4><span data-contrast=\"none\">Getting\u00a0Started<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559738&quot;:40,&quot;335559739&quot;:0,&quot;335559740&quot;:259}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"auto\">With the new Application Access Policy,\u00a0you\u2019ll\u00a0be able to provide users a more secure experience using EWS. Learn more\u00a0<\/span><a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/exchange\/organization\/new-applicationaccesspolicy?view=exchange-ps\"><span data-contrast=\"none\">here<\/span><\/a><span data-contrast=\"none\">.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">The Exchange Team<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:259}\">\u00a0<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>We previously introduced Application Access Policy support for Microsoft Graph, and we are now adding Application Access Policy support to Exchange Web Services (EWS) in Exchange Online.<\/p>\n","protected":false},"author":69080,"featured_media":25159,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[3],"tags":[69],"class_list":["post-5926","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-graph","tag-exchange"],"acf":[],"blog_post_summary":"<p>We previously introduced Application Access Policy support for Microsoft Graph, and we are now adding Application Access Policy support to Exchange Web Services (EWS) in Exchange Online.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/posts\/5926","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/users\/69080"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/comments?post=5926"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/posts\/5926\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/media\/25159"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/media?parent=5926"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/categories?post=5926"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/tags?post=5926"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}