Role Based Access Control for Applications in Exchange Online

Publisher

Microsoft

URL

https://learn.microsoft.com/en-us/exchange/permissions-exo/application-rbac

Published

2026-08-21

Updated

unknown

Accessed

2026-09-30

HTTP status

200

License

Microsoft Learn terms of use; no-redistribution; short excerpts and locators only

Source notes citing this source

• Application Access Policies constrain only the permissions assigned in Microsoft Entra ID, and Microsoft says Entra permissions can only be constrained using Application Access Policies. in context
• Changes to application permissions in Exchange Online RBAC for Applications are subject to a cache that lasts between 30 minutes and 2 hours depending on the app's recent usage. in context
• Microsoft states that RBAC for Applications in Exchange Online replaces Application Access Policies. in context
• Permissions granted in Microsoft Entra ID and permissions assigned through Exchange Online RBAC for Applications combine as a union, so an unscoped Entra grant left in place defeats a resource-scoped RBAC grant of the same permission. in context

Cite this source record

APA

WarmTransfer. (2026, August 21). Role Based Access Control for Applications in Exchange Online. WarmTransfer. https://warmtransfer.net/knowledge/sources/ms-learn-exo-application-rbac

BibTeX

@misc{warmtransfer-ms-learn-exo-application-rbac,
  title  = {Role Based Access Control for Applications in Exchange Online},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/sources/ms-learn-exo-application-rbac},
  note   = {Microsoft, accessed 2026-09-30}
}