Microsoft Modern Exchange Connector (Graph): Permissions and Granting Consent

Applies to: Microsoft Modern Exchange Connector (Graph) integrations with Riva

This article explains the Microsoft Graph permissions Riva uses, the Riva features they support, and how to grant supported Exchange mailbox permissions either tenant-wide through Microsoft Entra or mailbox-scoped through Exchange Online RBAC for Applications.

Overview

Riva uses Microsoft Graph permissions to access Exchange Online data required by the enabled sync features.

There are two ways to grant supported Exchange mailbox permissions to Riva:

Microsoft Entra application permissions: Grant tenant-wide access to the applicable Exchange data type after tenant admin consent is provided.
Exchange Online RBAC for Applications: Grant the applicable Exchange permission only for a defined mailbox scope, such as the mailboxes included in an approved group or management scope.

When Exchange Online RBAC for Applications is used, supported mailbox permissions do not need to remain granted tenant-wide in Microsoft Entra.

Riva recommends Exchange Online RBAC for Applications whenever customers want to limit Riva’s access to only the mailboxes participating in the integration. See How Microsoft Entra and Exchange RBAC Permissions Work Together for important scoping considerations.

Required Permissions

The permissions Riva requires depend on the synchronization modules and optional features enabled for the integration.

The following table identifies the Microsoft Graph permissions Riva uses, the features they support, and where each permission can be granted.

Permission	Used by Riva	Permission Grant Location	Notes
`Mail.ReadWrite`	Email sync and the `RivaConfiguration` folder	Microsoft Entra or Exchange RBAC (can be scoped)	Riva requires read/write access to maintain the `RivaConfiguration` folder, a sync-safety feature recommended for all synchronizations.
`Calendars.ReadWrite`	Calendar sync	Microsoft Entra or Exchange RBAC (can be scoped)	Required only when Calendar sync module is enabled. Can be changed to `Calendars.Read` if write access is not required.
`Contacts.ReadWrite`	Contact sync	Microsoft Entra or Exchange RBAC (can be scoped)	Required only when Contact sync is enabled. Can be limited to `Contacts.Read` if write access is unnecessary.
`Tasks.ReadWrite.All`	Task and task-list sync	Microsoft Entra only (tenant-wide)	Required only when Task sync is enabled.
`MailboxSettings.ReadWrite`	Reading and updating mailbox settings, including Riva categories	Microsoft Entra or Exchange RBAC (can be scoped)	Used to maintain the `MasterCategory` list and Riva-specific categories with the specific admin-defined colours.
`Mail.Send`	Sending messages for supported Riva functionality	Microsoft Entra or Exchange RBAC (can be scoped)	Allows Riva to send messages, such as tracking tokens, forwarded emails, and optional email summaries of errors encountered during sync. Required only when an enabled Riva feature sends email.
`GroupMember.Read.All`	Distribution-list expansion and group-membership lookup	Microsoft Entra only (tenant-wide)	Required only when this functionality is enabled.
`User.Read.All`	Looking up user profiles and mailbox email addresses	Microsoft Entra only (tenant-wide)	Required when Riva needs to look up email addresses to match Microsoft mailboxes.
`User.Read`	Looking up the consenting administrator’s profile during the Riva Cloud shared-tenant admin-consent flow.	Microsoft Entra only (tenant-wide)	Delegated permission. Required only for the applicable Riva Cloud consent flow; it is not required for Riva On-Premise deployments.
`MailboxFolder.Read.All`	Declined Appointment Polling	Microsoft Entra or Exchange RBAC (can be scoped)	Allows Riva to read all the users' mailbox folders. Required only when Declined Appointment Polling is enabled.
`MailboxItem.Read.All`	Declined Appointment Polling	Microsoft Entra or Exchange RBAC (can be scoped)	Allows Riva to read all the users' mailbox items, without signed-in user. Required only when Declined Appointment Polling is enabled.

How Permissions Are Granted

Tenant-wide Microsoft Entra permissions

Microsoft Entra application permissions grant Riva access across the Microsoft 365 tenant for the applicable data type. These permissions require tenant admin consent.

Use Microsoft Entra permissions when:

The permission cannot currently be assigned through Exchange Online RBAC for Applications.
Riva requires tenant-wide access for the enabled feature.
A customer has chosen not to use mailbox-scoped Exchange RBAC.

Mailbox-scoped Exchange Online RBAC permissions

Exchange Online RBAC for Applications assigns supported Microsoft Graph permissions directly to the Riva service principal and limits them to a defined mailbox scope.

Use Exchange RBAC when:

Riva should access only approved mailboxes.
The required Graph permission is supported by Exchange RBAC.
The equivalent tenant-wide Microsoft Entra application permission has been removed.

Exchange RBAC permissions are assigned in Exchange Online and do not require the equivalent Microsoft Graph application permission to remain consented in Microsoft Entra.

Configuring a Mailbox-Scoped Riva Integration

To use Exchange Online RBAC for Applications:

Identify the Riva features and sync modules that will be enabled.
Assign the corresponding supported Exchange RBAC application roles to the Riva service principal.
Apply each role assignment to the approved mailbox scope.
Remove the equivalent tenant-wide Microsoft Entra application permission for every permission that must be mailbox-scoped.
Retain any permissions that Exchange RBAC does not support in Microsoft Entra, with tenant admin consent.
Test the Riva service principal’s Exchange RBAC access before enabling or updating synchronization.

For example, to scope calendar synchronization to approved mailboxes only:

Remove Calendars.ReadWrite from the Riva enterprise application’s Microsoft Entra permissions.
Assign Application Calendars.ReadWrite to the Riva service principal in Exchange Online.
Apply that role assignment to the approved mailbox scope.

Riva can then access calendar data only for mailboxes included in that scope, provided no separate tenant-wide permission grants equivalent access.

How Microsoft Entra and Exchange RBAC Permissions Work Together

Exchange Online RBAC does not restrict an equivalent tenant-wide permission that remains granted in Microsoft Entra.

For example, if Riva has both of the following:

Calendars.ReadWrite consented tenant-wide in Microsoft Entra, and
Application Calendars.ReadWrite assigned through Exchange RBAC to a limited mailbox scope,

Riva retains tenant-wide calendar access because the Microsoft Entra grant remains in effect.

To achieve mailbox-scoped access, grant the supported permission through Exchange RBAC and remove the equivalent tenant-wide Microsoft Entra permission.

Granting Admin Consent

If your Riva configuration uses one or more permissions granted through Microsoft Entra, a tenant administrator must grant admin consent for those permissions.

Sign in to the Microsoft Entra admin center.
Go to Entra ID > App registrations > All applications.
Select the application created for Riva.
Under Manage, select API permissions.
Review the configured permissions.
Select Grant admin consent for [Tenant Name].
Review the consent prompt, and then select Yes.

Admin consent grants the selected Microsoft Entra permissions tenant-wide. It does not grant or restrict permissions assigned through Exchange Online RBAC for Applications.

Note: Existing Microsoft Graph connections do not require revalidation. However, an administrator must grant consent when adding a new Microsoft Entra permission required by an enabled Riva feature.

EWS vs. Microsoft Graph Permissions

The EWS and Microsoft Graph permission models are structured differently, so there is not a direct one-to-one mapping between an EWS permission and an individual Microsoft Graph permission.

With EWS, Riva used the broad delegated EWS.AccessAsUser.All permission. This permission allows the application to access Exchange Web Services as the authenticated user and perform operations permitted to that user.

Microsoft Graph instead separates Exchange access into distinct, workload-specific permissions, such as mail, calendar, contacts, mailbox settings, tasks, and group membership.

The Required Permissions table identifies the permissions Riva uses for each enabled feature and whether each can be granted tenant-wide through Microsoft Entra, mailbox-scoped through Exchange Online RBAC for Applications, or only through Microsoft Entra.

Troubleshooting

Issue	Suggested Action
Access to mailboxes failing	Ensure that the target mailboxes are included in the Exchange RBAC resource scope assigned to Riva.
Permissions not taking effect	Allow time for permission changes to propagate. Exchange Online RBAC changes can take up to two hours to take effect.
Admin consent fails	Ensure you are using a Global Administrator account
Graph API errors in Riva	Check that the necessary Graph permissions are granted and consented properly
Riva can access mailboxes outside the intended RBAC scope	Check whether the equivalent tenant-wide Microsoft Entra permission is still granted. Microsoft Entra and Exchange RBAC permissions are additive.

Related to