Microsoft Modern Exchange Connector (Graph): Permissions and Granting Consent

Applies to: Microsoft Modern Exchange Connector (Graph) integrations with Riva

This article outlines the permissions Riva requires when integrating with Microsoft Graph, how to grant those permissions via Azure Active Directory, and how to securely limit mailbox access using Microsoft’s Role-Based Access Control (RBAC) for Applications.

Overview

Riva uses Microsoft Graph to access mailbox data for syncing purposes (email, calendar, tasks, etc.). Microsoft Graph requires application-level permissions for server-to-server integration scenarios, meaning the application acts as itself — not on behalf of a user.

Required Permissions

When setting up Riva with Microsoft Graph, the following permissions are required in Azure Active Directory > App registrations:

Granting Admin Consent

Once the permissions are configured for the Riva application, admin consent must be granted:

1. Sign in to the Azure portal.
2. Go to Azure Active Directory > Enterprise Applications.
3. Find and select your Riva application.
4. Click Permissions > Grant admin consent for [Tenant Name].

This consent allows Riva to access mailboxes based on the permissions granted.

Limiting Mailbox Access (Recommended)

By default, application permissions grant access to all mailboxes in the Microsoft 365 tenant. To apply the principle of least privilege and limit Riva’s access only to specific users, Microsoft now recommends using Role-Based Access Control (RBAC) for Applications.

Riva strongly recommends this approach for securing your integration.

See detailed steps in our guide:
Limiting Mailbox and User Access with Application Permissions using RBAC

RBAC Highlights

• Use a mail-enabled security group to define which mailboxes Riva can access.
• Create a custom management scope in Exchange Online.
• Assign that scope to the Riva application using a management role assignment.
• Verify access using PowerShell.

Note: Microsoft is phasing out Application Access Policies. RBAC for Applications is the long-term supported method for access control.

After Consent and RBAC

Once permissions and scope have been granted:

• Riva will automatically detect and use Microsoft Graph as the sync method.
• Only mailboxes within the RBAC-defined scope (security group) will be synced.
• No user passwords or interactive logins are required.

EWS vs. Microsoft Graph Permissions

The EWS and Microsoft Graph permission models are structured differently, so there is not a direct one-to-one mapping between an EWS permission and an individual Microsoft Graph permission.

With EWS, Riva used the broad delegated EWS.AccessAsUser.All permission. This permission allows the application to access Exchange Web Services as the authenticated user and perform operations permitted to that user. 

Microsoft Graph instead separates access according to the specific Exchange workload or operation being performed. For the Microsoft Modern Exchange Connector, Riva requests a collection of Graph permissions, including permissions such as:

• Mail.ReadWrite - read and write mailbox email

• Mail.Send - send email

• Calendars.ReadWrite - read and write calendar items

• Contacts.ReadWrite - read and write calendar items

• MailboxSettings.ReadWrite - read and modify mailbox settings

Additional permissions are used where required for specific Riva functionality, such as tasks, group membership, mailbox folders, or mailbox items.

How Graph Access Compares

The key difference is how Microsoft expresses the permissions.

EWS exposes relatively broad Exchange permissions, whereas Microsoft Graph uses separate permissions for individual Exchange workloads and capabilities. As a result, what previously appeared as a broad EWS access grant is represented in Graph by several distinct permissions.

For the Modern Exchange Connector, most of the relevant Graph permissions are application permissions. These permissions provide Riva with the mailbox capabilities needed to perform synchronization operations for the enabled features, such as email, calendar, contacts, tasks, and mailbox settings.

Mailbox Scope

By default, relevant Microsoft Graph application permissions can access applicable mailboxes across the Microsoft 365 tenant once admin consent is granted. For example, Mail.ReadWrite can allow access to mailbox email across the tenant, while Calendars.ReadWrite and Contacts.ReadWrite provide comparable access to those data types.

Exchange Online RBAC for Applications provides a separate way to grant mailbox permissions to a defined scope. These permissions are additive to permissions granted through the Enterprise Application; RBAC does not override or restrict an equivalent tenant-wide Graph permission.

For example, if Calendars.ReadWrite remains granted in the Enterprise Application, Riva can still access applicable calendars across the tenant even if Application Calendars.ReadWrite is also assigned through RBAC to a limited mailbox scope.

To apply mailbox-level restrictions:

• In the Enterprise Application, retain only permissions that must remain tenant-wide or cannot be assigned through Exchange Online RBAC.
• In Exchange Online RBAC, assign each supported mailbox permission to the required mailbox scope.
• To restrict a supported permission, remove the equivalent tenant-wide Graph permission from the Enterprise Application and grant it only through the corresponding scoped RBAC application role.

For example, to restrict calendar access, remove Calendars.ReadWrite from the Enterprise Application and grant Application Calendars.ReadWrite only to the approved RBAC scope.

Summary

The EWS and Graph permission sets are not a 1:1 match.

EWS used a broader delegated Exchange permission model to access mailbox data. 

Microsoft Graph uses multiple workload-specific permissions—such as mail, calendar, contacts, and mailbox settings—to provide the same functional access required by the enabled Riva features.

Graph application permissions are tenant-wide by default and can be scoped to specific mailboxes using Exchange Online RBAC for Applications.

In practice, Microsoft Graph provides the Exchange capabilities Riva requires through separate, granular, workload-specific permissions rather than through a single broad EWS permission. The permissions and consent model differ, but they support the same Riva synchronization functions when configured for the applicable features and mailbox scope.

Troubleshooting

Related Articles

• Limiting Mailbox and User Access with Application Permissions using RBAC
• Connect to Exchange Online PowerShell
• Microsoft Graph API Permissions Reference