However, in testing my RestrictAccess policy using the command, Test-ApplicationAccessPolicy, I am getting results for all mailboxes as “granted”? I haven’t tried the code above, but shouldn’t I be getting a “denied” result with a restrict policy in place? Now I’m confused if this solution works as described?

It’s supported just fine, you can find the original blog post announcing this here: https://techcommunity.microsoft.com/t5/exchange-team-blog/application-access-policy-support-in-ews/ba-p/2110361

When the documentation will be updated, I cannot tell you. They might even not add it there, as that article is specific to the Graph API, not EWS.

In the documentation of Microsoft https://docs.microsoft.com/en-us/graph/auth-limit-mailbox-access it’s mentioned the application access policy is only supported for below permissions:

– Mail.Read
– Mail.ReadBasic
– Mail.ReadBasic.All
– Mail.ReadWrite
– Mail.Send
– MailboxSettings.Read
– MailboxSettings.ReadWrite
– Calendars.Read
– Calendars.ReadWrite
– Contacts.Read
– Contacts.ReadWrite

There is nothing mentioned about the full_access_as_app permission. Could you please confirm the application access policy is also working for the full_access_as_app permission or is this not supported?

Thank you in advance

Kind regards

Juan