Permissions granted in Microsoft Entra ID and permissions assigned through Exchange Online RBAC for Applications combine as a union, so an unscoped Entra grant left in place defeats a resource-scoped RBAC grant of the same permission.
Checked 2026-09-30
- Vendor
- Microsoft
- Product
- Exchange Online
- Subsystem
- application permissions
- Deployment
- multi-tenant
- Region
- not restricted
- Release range
- current as of 2026-09-30
- Checked
- 2026-09-30
Sources
- Role Based Access Control for Applications in Exchange Online — Microsoft · tier 2 current vendor documentation · FAQ > Why does my application still have access to mailboxes that aren't granted by the scope I used...
Cite this note
APA
WarmTransfer. (2026, September 30). Setting up Unity Connection single inbox with Microsoft 365: source note unity-connection-single-inbox-setup-rbac-union. WarmTransfer. https://warmtransfer.net/knowledge/claims/unity-connection-single-inbox-setup-rbac-union
BibTeX
@misc{warmtransfer-claim-unity-connection-single-inbox-setup-rbac-union,
title = {Setting up Unity Connection single inbox with Microsoft 365: source note unity-connection-single-inbox-setup-rbac-union},
author = {{WarmTransfer}},
year = {2026},
url = {https://warmtransfer.net/knowledge/claims/unity-connection-single-inbox-setup-rbac-union},
note = {Source note unity-connection-single-inbox-setup-rbac-union, checked 2026-09-30}
}