Updating emails in a Shared Mailbox using an Azure Client Application and Microsoft Graph SDK - microsoft-graph-sdks

Question

I'm trying to update email categories of items in a Shared Mailbox using Microsoft Graph SDK.
This is the code used to create the Graph SDK Client. It uses the Azure Client Application credentials (ClientId, TenantId, Secret):
var handlers = GraphClientFactory.CreateDefaultHandlers(new DelegateAuthenticationProvider(async msg =>
{
var accessToken = await GetAccessTokenFromCacheOrRefresh(cancellationToken);
msg.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
}));
handlers.Add(_graphLoggingHandler);
var httpClient = GraphClientFactory.Create(handlers);
_graphServiceClient = new GraphServiceClient(httpClient);
This is the code used to update the message categories:
var updatedMessage = new Message();
updatedMessage.Categories = CreateMessageCategories();
await _graphServiceClient.Users[emailAddress].Messages[emailId]
.Request()
.UpdateAsync(updatedMessage, cancellationToken);
When I run this code, I get the error "Access Denied". What permissions do I need to update messages in this Shared MailBox? The Administrators tell me I can't use Mail.ReadWrite on the Application level because that will allow the application to modify emails in all mailboxes.

Answer 1

When the app is configured with application permissions, then the app has access to all mailboxes by default.
Tenant administrators can create an application access policy by using the New-ApplicationAccessPolicy PowerShell cmdlet to limit an app to only specific mailboxes and not all Exchange Online mailboxes in the organization.
More details:
Limiting application permissions to specific Exchange Online mailboxes