> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enterprise.emailmeter.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Restrict access in Microsoft 365

> Restrict Email Meter access to specific mailboxes only

![](https://storage.googleapis.com/em-docs/enterprise-documentation/images/restrict-microsoft.webp)

As an administrator, you can limit Email Meter's access to a specific group of mailboxes rather than your entire organization. In Microsoft 365, this is done in two steps: creating a mail-enabled security group with the mailboxes you want to track, and creating an ApplicationAccessPolicy in Exchange Online that restricts Email Meter to that group.

> [!NOTE]
>
> Microsoft 365 doesn't offer this option during installation. You set it up afterwards, at any time: right after granting admin consent, or once Email Meter is already up and running.

## Create a mail-enabled security group

Log into your Microsoft 365 admin portal and go to `Groups > Active`.

![](https://storage.googleapis.com/em-docs/enterprise-documentation/images/restrictmicrosoft--001.webp)

Choose `Mail-enabled security` on the secondary navigation menu.

![](https://storage.googleapis.com/em-docs/enterprise-documentation/images/restrictmicrosoft--002.webp)

Click on `Add a group` to create a new group.

![](https://storage.googleapis.com/em-docs/enterprise-documentation/images/restrictmicrosoft--003.webp)

On the following screen, select `Mail-enabled security group`. Then, choose a name, owners and members.

![](https://storage.googleapis.com/em-docs/enterprise-documentation/images/restrictmicrosoft--004.webp)

Once created, click into the group and open `Members` to choose the mailboxes you want to include. Those will be the only mailboxes that Email Meter will be able to get data from.

![](https://storage.googleapis.com/em-docs/enterprise-documentation/images/restrictmicrosoft--005.webp)

## Create an ApplicationAccessPolicy

Now you’ll need to create an ApplicationAccessPolicy to limit Email Meter's access to the mailboxes you’ve added to the Mail-enabled security group.

> [!NOTE]
>
> This step can only be done through Exchange Online PowerShell: Microsoft doesn't offer a way to create application access policies from the admin center. For detailed instructions on connecting to Exchange Online PowerShell, please read Microsoft's documentation [here](https://learn.microsoft.com/en-us/powershell/exchange/exchange-online/connect-to-exchange-online-powershell/connect-to-exchange-online-powershell?view=exchange-ps\&preserve-view=true).

In PowerShell, run the following command, replacing the arguments for PolicyScopeGroupId, and Description.

```powershell theme={null}
New-ApplicationAccessPolicy -AppId ded01d8e-6870-47b2-8d53-0278cf850df1 -PolicyScopeGroupId securitygroup@yourcompany.com -AccessRight RestrictAccess -Description "Restrict this app to members of the Mail-enabled security group."
```

## Test the restriction

Once this is done, you can test that the policy is restricting access by running a PowerShell command. Just replace the argument for Identity:

```powershell theme={null}
Test-ApplicationAccessPolicy -Identity exampleuser@yourcompany.com -AppId ded01d8e-6870-47b2-8d53-0278cf850df1
```

The `AccessCheckResult` field in the output tells you whether Email Meter can access that mailbox: `Granted` means it can, `Denied` means it can't. Test with a mailbox that is **not** a member of the security group. If the result is `Denied`, the restriction is working. If it's `Granted`, double check that the policy points to the right group and that the group is of the Mail-enabled security type.

> [!WARNING]
>
> Changes to application access policies can take longer than 1 hour to take effect in Microsoft Graph REST API calls, even when Test-ApplicationAccessPolicy shows positive results.

## What to expect in Email Meter

Once the policy is in effect:

* **Adding mailboxes**: when you try to add a mailbox that isn't a member of the security group, the mailbox check will fail with the message "Email Meter can't access this mailbox".
* **Mailboxes added before the policy**: if a mailbox that isn't in the group was added to your dashboard before the policy took effect, it will stop receiving new data and show a sync error. Add it to the security group, or remove it from your dashboard.

## Frequently asked questions

> [accordion] Do I need to grant access to everyone using Email Meter?
>
> No, it's not necessary to grant access to all users who access Email Meter. Email Meter requires access only to the mailboxes that are being tracked: this means that only the accounts for which you want to generate email statistics need to be granted access.

> [accordion] Can I set this up after installing Email Meter?
>
> Yes. In Microsoft 365 this is the only way: the restriction is always configured after admin consent has been granted. Keep in mind that any mailbox already being tracked that isn't a member of the security group will stop syncing once the policy applies.

> [accordion] How do I change which mailboxes Email Meter can access?
>
> Just add or remove members from the Mail-enabled security group. You don't need to change the policy: it always applies to the current members of the group. Remember that changes can take longer than 1 hour to take effect.
>
> If you want to point the policy to a different group, remove it and create a new one:
>
> ```powershell theme={null}
> Get-ApplicationAccessPolicy
> Remove-ApplicationAccessPolicy -Identity "Identity value from the previous command"
> ```

> [accordion] I created the policy, but Email Meter can still access mailboxes outside the group
>
> The most common cause is propagation time: changes to application access policies can take longer than 1 hour to reach Microsoft Graph, even when `Test-ApplicationAccessPolicy` already shows the expected results. If it still happens after that, check the following:
>
> * **Test the right mailbox**: run `Test-ApplicationAccessPolicy` against a mailbox that is not in the group. The result should be `Denied`. If it's `Granted`, the policy isn't restricting anything yet.
> * **Check the group type**: the policy only works with Mail-enabled security groups. Distribution lists and Microsoft 365 groups won't work.
> * **Check for other policies**: if any other RestrictAccess policy for Email Meter includes the mailbox, access is granted. Run `Get-ApplicationAccessPolicy` to review existing policies and remove the ones you don't want.

> [accordion] Can I include shared mailboxes?
>
> Yes. Shared mailboxes can't be used directly as the policy scope, but you can add them as members of the Mail-enabled security group and they'll be covered by the policy like any other member.

> [accordion] What happens if I remove a mailbox from the security group?
>
> Email Meter will lose access to the mailbox and will no longer be able to gather email statistics from it. In your dashboard, the mailbox will show a sync error until you add it back to the group or remove it from tracking.

> [accordion] Can I use RBAC for Applications instead of an ApplicationAccessPolicy?
>
> Yes. Microsoft is replacing Application Access Policies with [Role Based Access Control for Applications](https://learn.microsoft.com/en-us/exchange/permissions-exo/application-rbac), also configured through Exchange Online PowerShell only. Existing policies keep working and Microsoft hasn't announced a deprecation date, so the steps on this page remain valid.
>
> If your organization prefers RBAC for Applications, keep in mind that permissions from both systems are additive: for the resource scope to take effect, the tenant-wide permission granted during installation must be removed in Microsoft Entra ID. Reach out to us before making this change so we can make sure your mailboxes keep syncing.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.