How to restrict CasEngine's access to specific mailboxes in Microsoft 365

When you connect CasEngine to Microsoft 365 email, the CasEngine application is granted application-level mail permissions. By default, Microsoft lets an app with these permissions reach every mailbox in your organisation. This article shows your Microsoft 365 administrator how to limit CasEngine so it can only access the mailboxes you choose, using an Exchange Online Application Access Policy.

Before you start

• You need an account with the Exchange Administrator or Global Administrator role in your Microsoft 365 tenant.
• You need a Windows computer with PowerShell 5.1 or PowerShell 7, run as Administrator.
• You need the CasEngine Application (Client) ID. You can find it in the Microsoft Entra admin center under Enterprise applications > CasEngine > Application ID, or ask CasEngine Support to confirm it.
• Have a list of the mailboxes (users and shared mailboxes) that CasEngine should be allowed to access.

Values you will use

Replace the placeholders below with your own values in every command.

Step 1 – Create a mail-enabled security group

This group defines which mailboxes CasEngine is allowed to access.

1. Sign in to the Exchange admin center at https://admin.exchange.microsoft.com.
2. Go to Recipients > Groups > Mail-enabled security tab, then click Add a group.
3. Choose Mail-enabled security, then give the group a clear name, for example CasEngine Mailboxes, and an email address such as casengine-mailboxes@yourfirm.com.
4. Add as members every mailbox CasEngine should access (user mailboxes and shared mailboxes).
5. Click Create group.

Step 2 – Install the Exchange Online PowerShell module

Open PowerShell as Administrator and run:

Install-Module -Name ExchangeOnlineManagement
Import-Module ExchangeOnlineManagement

If you are asked to trust the PSGallery repository, type Y and press Enter. If the module is already installed, you can skip the first line.

Step 3 – Connect to Exchange Online

Connect-ExchangeOnline -UserPrincipalName <AdminUPN>

A Microsoft sign-in window will open. Sign in with your administrator account and complete MFA if prompted.

Step 4 – Create the application access policy

This command tells Exchange Online that CasEngine may only access mailboxes that are members of the group from Step 1.

New-ApplicationAccessPolicy -AppId <AppId> -PolicyScopeGroupId <GroupEmail> -AccessRight RestrictAccess -Description "Restrict CasEngine to members of <GroupEmail>"

When it succeeds, PowerShell shows the new policy with AccessRight : RestrictAccess.

Step 5 – Test the policy

Check a mailbox that is in the group:

Test-ApplicationAccessPolicy -Identity <AllowedMailbox> -AppId <AppId>

Expected result: AccessCheckResult : Granted

Check a mailbox that is not in the group:

Test-ApplicationAccessPolicy -Identity <OtherMailbox> -AppId <AppId>

Expected result: AccessCheckResult : Denied

When finished, disconnect:

Disconnect-ExchangeOnline -Confirm:$false

Managing access later

• Give CasEngine access to another mailbox: add that mailbox to the group. No PowerShell change is needed.
• Remove access: remove the mailbox from the group.
• View the policy: Get-ApplicationAccessPolicy
• Remove the policy (CasEngine will again be able to reach all mailboxes): Remove-ApplicationAccessPolicy -Identity "<PolicyIdentity>", using the Identity value shown by Get-ApplicationAccessPolicy.

Troubleshooting

Need help?

If you get stuck, raise a ticket with CasEngine Support and include a screenshot of the PowerShell output (please hide any passwords or personal data). Our team can join a screen-share session to complete the setup with your administrator.

Reference: Microsoft documentation – Limiting application permissions to specific Exchange Online mailboxes.