Microsoft Graph - Scoping Application Mail permissions

Segfault 0
Viewed 30

I am leveraging the graph api in powershell to automatically send emails to users.

This script is designed to run unattendedly, so i can not impersonate a user by logging in interactively.

In order to do so, i've created a service principal with application* permissions to the mail service of the tenant.
Permissions

However the mail permissions that can be assigned are far too large, as i don't want this service to be able to send mail as any user.

Is there a way to scope this permission such as my SP could only send mail with a specific service account that i would provision in azure ad, with the constraint of not being able to log in interactively prior to the script execution ?

graph service email azure
1 Answers

Having Delegated Mail.Send permissions would limit it to only the delegated user, which sounds like what you're after.

The dilemma though is that are running a PS script (a.k.a. no user involvement). You need user involvement to use Delegated, so yip...

You could contrive something like this:

  • Setup Delegated permissions for sending mail
  • Let the user log in once (somewhere) with your service principal, capturing their "refresh token"
  • Let the PS script lookup the "refresh token" for the user to create an access token
  • Use access token to send email "that specific" delegated user.

Unfortunately you won't be able to have "Delegated permissions" with no user interaction, so if that's the case, you're going to have to stick with the "wider" app permissions as you currently have.

Niels Filter0
Related