Skip to content

Commit a39f0c0

Browse files
chrisdachrisda
authored
Merge pull request MicrosoftDocs#3490 from MicrosoftDocs/AppAccessPol
AppAccessPol to Master
2 parents 0885d11 + 458c263 commit a39f0c0

File tree

5 files changed

+631
-0
lines changed

5 files changed

+631
-0
lines changed

‎exchange/exchange-ps/exchange/organization/Get-ApplicationAccessPolicy.md

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
---
2+
external help file: Microsoft.Exchange.ServerStatus-Help.xml
3+
applicable: Exchange Online
4+
title: Get-ApplicationAccessPolicy
5+
schema: 2.0.0
6+
monikerRange: "exchonline-ps"
7+
---
8+
9+
# Get-ApplicationAccessPolicy
10+
11+
## SYNOPSIS
12+
This cmdlet is available only in the cloud-based service.
13+
14+
Use the Get-ApplicationAccessPolicy cmdlet to view the list of application access policies.
15+
16+
For information about the parameter sets in the Syntax section below, see Exchange cmdlet syntax (https://technet.microsoft.com/library/bb123552.aspx).
17+
18+
## SYNTAX
19+
20+
### Set1
21+
```
22+
Get-ApplicationAccessPolicy [[-Identity] <ApplicationAccessPolicyIdParameter>] [<CommonParameters>]
23+
```
24+
25+
## DESCRIPTION
26+
This feature applies only to apps connecting to the Microsoft Graph API for Outlook resources.
27+
28+
You need to be assigned permissions before you can run this cmdlet. Although this topic lists all parameters for the cmdlet, you may not have access to some parameters if they're not included in the permissions assigned to you. To find the permissions required to run any cmdlet or parameter in your organization, see Find the permissions required to run any Exchange cmdlet (https://technet.microsoft.com/library/mt432940.aspx).
29+
30+
## EXAMPLES
31+
32+
### -------------------------- Example 1 --------------------------
33+
```
34+
Get-ApplicationAccessPolicy | Format-Table -Auto Description,ScopeName,AccessRight
35+
```
36+
37+
This example returns a summary list of all application access policies in the organization.
38+
39+
### -------------------------- Example 2 --------------------------
40+
```
41+
Get-ApplicationAccessPolicy -Identity "596ade3a-1abe-4c5b-b7d5-a169c4b05d4a\7a774f0c-7a6f-11e0-85ad-07fb4824019b:S-1-5-21-724521725-2336880675-2689004279-1821338;8b6ce428-cca2-459a-ac50-d38bcc932258"
42+
```
43+
44+
This example returns detailed information for the specified application access policy.
45+
46+
## PARAMETERS
47+
48+
### -Identity
49+
The Identity parameter specifies the application access policy that you want to view. To find the Identity value for the policy, run the command Get-ApplicationAccessPolicy | Format-List Identity,Description,ScopeName,AccessRight,AppID.
50+
51+
```yaml
52+
Type: ApplicationAccessPolicyIdParameter
53+
Parameter Sets: (All)
54+
Aliases:
55+
Applicable: Exchange Online
56+
Required: True
57+
Position: 1
58+
Default value: None
59+
Accept pipeline input: True
60+
Accept wildcard characters: False
61+
```
62+
63+
### CommonParameters
64+
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters (https://go.microsoft.com/fwlink/p/?LinkID=113216).
65+
66+
## INPUTS
67+
68+
###
69+
70+
## OUTPUTS
71+
72+
###
73+
74+
## NOTES
75+
76+
## RELATED LINKS
77+
78+
[Online Version](https://docs.microsoft.com/powershell/module/exchange/organization/get-applicationaccesspolicy)

‎exchange/exchange-ps/exchange/organization/New-ApplicationAccessPolicy.md

Lines changed: 220 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,220 @@
1+
---
2+
external help file: Microsoft.Exchange.ServerStatus-Help.xml
3+
applicable: Exchange Online
4+
title: New-ApplicationAccessPolicy
5+
schema: 2.0.0
6+
monikerRange: "exchonline-ps"
7+
---
8+
9+
# New-ApplicationAccessPolicy
10+
11+
## SYNOPSIS
12+
This cmdlet is available only in the cloud-based service.
13+
14+
Use the New-ApplicationAccessPolicy cmdlet to restrict or deny access for an application that is using Outlook Rest APIs or Microsoft Graph APIs to a specific set of mailboxes. These policies are complimentary to the permission scopes that are declared by the application.
15+
16+
For information about the parameter sets in the Syntax section below, see Exchange cmdlet syntax (https://technet.microsoft.com/library/bb123552.aspx).
17+
18+
## SYNTAX
19+
20+
### Set1
21+
```
22+
New-ApplicationAccessPolicy -AccessRight <RestrictAccess | DenyAccess> -AppId <String[]> -PolicyScopeGroupId <RecipientIdParameter>
23+
[-Confirm]
24+
[-Description <String>]
25+
[-WhatIf] [<CommonParameters>]
26+
```
27+
28+
## DESCRIPTION
29+
You need to be assigned permissions before you can run this cmdlet. Although this topic lists all parameters for the cmdlet, you may not have access to some parameters if they're not included in the permissions assigned to you. To find the permissions required to run any cmdlet or parameter in your organization, see Find the permissions required to run any Exchange cmdlet (https://technet.microsoft.com/library/mt432940.aspx).
30+
31+
Use the New-ApplicationAccessPolicy cmdlet to restrict or deny access for an application that is using Outlook Rest APIs or Microsoft Graph APIs to a specific set of mailboxes. These policies are complimentary to the permission scopes that are declared by the application.
32+
33+
While the scope-based resource access like Mail.Read or Calendar.Read is effective to ensure that the application can only read mails or events within a mailbox and not do anything else; Application Access Policy feature allows admins to enforce limits that are based on a list of mailboxes. For example, in a global organization apps developed for one country shouldn’t have access to data from other countries or a CRM integration application should only access calendar of the Sales organization and no other departments.
34+
35+
Every API request using the Outlook Rest APIs or Microsoft Graph APIs to a target mailbox done by an application is verified using the following rules (in the same order):
36+
37+
1. If there are multiple application access policies for the same Application and Target Mailbox pair, DenyAccess policy is prioritized over a RestrictAccess policy.
38+
2. If a DenyAccess policy exists for the Application and Target Mailbox, then the app's access request is denied (even if there exists a RestrictAccess policy).
39+
3. If there are any RestrictAccess policies that match the Application and Target Mailbox, then the app is granted access.
40+
4. If there are any Restrict policies for the Application, and the Target Mailbox is not a member of those policies, then application is denied access to the target mailbox.
41+
5. If none of the above conditions are met, then the application is granted access to the requested target mailbox.
42+
43+
## EXAMPLES
44+
45+
### -------------------------- Example 1 --------------------------
46+
```
47+
New-ApplicationAccessPolicy -AccessRight DenyAccess -AppId 3dbc2ae1-7198-45ed-9f9f-d86ba3ec35b5,6ac794ca-2697-4137-8754-d2a78ae47d93 -PolicyScopeGroupId "Engineering Staff" -Description "Engineering Group Policy"
48+
```
49+
50+
This example creates a new application access policy with the following settings:
51+
52+
- AccessRight: DenyAccess
53+
54+
- AppIDs: 3dbc2ae1-7198-45ed-9f9f-d86ba3ec35b5 and 6ac794ca-2697-4137-8754-d2a78ae47d93
55+
56+
- PolicyScopeGroupId: Engineering Staff
57+
58+
- Description: Engineering Group Policy
59+
60+
### -------------------------- Example 2 --------------------------
61+
```
62+
New-ApplicationAccessPolicy -AccessRight RestrictAccess -AppId e7e4dbfc-046f-4074-9b3b-2ae8f144f59b -PolicyScopeGroupId [email protected] -Description "Restrict this app to members of distribution group EvenUsers."
63+
```
64+
65+
This example creates a new application access policy with the following settings:
66+
67+
- AccessRight: RestrictAccess
68+
69+
- AppIDs: e7e4dbfc-046f-4074-9b3b-2ae8f144f59b
70+
71+
- PolicyScopeGroupId: [email protected]
72+
73+
- Description: Restrict this app to members of distribution group EvenUsers.
74+
75+
76+
77+
### -------------------------- Example 3 --------------------------
78+
```
79+
New-ApplicationAccessPolicy -AccessRight DenyAccess -AppId e7e4dbfc-046f-4074-9b3b-2ae8f144f59b -PolicyScopeGroupId [email protected] -Description "Deny this app access to members of distribution group OddUsers."
80+
```
81+
82+
This example creates a new application access policy with the following settings:
83+
84+
- AccessRight: DenyAccess
85+
86+
- AppIDs: e7e4dbfc-046f-4074-9b3b-2ae8f144f59b
87+
88+
- PolicyScopeGroupId: [email protected]
89+
90+
- Description: Deny this app access to members of distribution group OddUsers.
91+
92+
## PARAMETERS
93+
94+
### -AccessRight
95+
The AccessRight parameter specifies the permission that you want to assign in the application access policy. Valid values are:
96+
97+
- RestrictAccess
98+
99+
- DenyAccess
100+
101+
```yaml
102+
Type: ApplicationAccessPolicyIdParameter
103+
Parameter Sets: (All)
104+
Aliases:
105+
Applicable: Exchange Online
106+
Required: True
107+
Position: Named
108+
Default value: None
109+
Accept pipeline input: False
110+
Accept wildcard characters: False
111+
```
112+
113+
### -AppId
114+
The Identity parameter specifies the GUID of the apps to include in the policy. To find the GUID value of an app, run the command Get-App | Format-Table -Auto DisplayName,AppId.
115+
116+
You can specify multiple app GUID values separated by commas or you can specify * to indicate all applications.
117+
118+
```yaml
119+
Type: String[]
120+
Parameter Sets: (All)
121+
Aliases:
122+
Applicable: Exchange Online
123+
Required: True
124+
Position: Named
125+
Default value: None
126+
Accept pipeline input: True
127+
Accept wildcard characters: False
128+
```
129+
130+
### -PolicyScopeGroupID
131+
The PolicyScopeGroupID parameter specifies the recipient to define in the policy. You can use any value that uniquely identifies the recipient. You can also specify a mail enabled security group or a distribution group or a dynamic distribution group to restrict/deny access to a large number of user mailboxes.
132+
For example:
133+
134+
- Name
135+
136+
- Distinguished name (DN)
137+
138+
- Display name
139+
140+
- Email address
141+
142+
- GUID
143+
144+
```yaml
145+
Type: RecipientIdParameter
146+
Parameter Sets: (All)
147+
Aliases:
148+
Applicable: Exchange Online
149+
Required: True
150+
Position: Named
151+
Default value: None
152+
Accept pipeline input: True
153+
Accept wildcard characters: False
154+
```
155+
156+
### -Confirm
157+
The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on if the cmdlet requires confirmation before proceeding.
158+
159+
- Destructive cmdlets (for example, Remove-\* cmdlets) have a built-in pause that forces you to acknowledge the command before proceeding. For these cmdlets, you can skip the confirmation prompt by using this exact syntax: -Confirm:$false.
160+
161+
- Most other cmdlets (for example, New-\* and Set-\* cmdlets) don't have a built-in pause. For these cmdlets, specifying the Confirm switch without a value introduces a pause that forces you acknowledge the command before proceeding.
162+
163+
```yaml
164+
Type: SwitchParameter
165+
Parameter Sets: (All)
166+
Aliases: cf
167+
Applicable: Exchange Server 2013, Exchange Server 2016, Exchange Online
168+
Required: False
169+
Position: Named
170+
Default value: None
171+
Accept pipeline input: False
172+
Accept wildcard characters: False
173+
```
174+
175+
### -Description
176+
The Description parameter specifies a description for the policy. If the value contains spaces, enclose the value in quotation marks (").
177+
178+
```yaml
179+
Type: String
180+
Parameter Sets: (All)
181+
Aliases:
182+
Applicable: Exchange Online
183+
Required: False
184+
Position: Named
185+
Default value: None
186+
Accept pipeline input: False
187+
Accept wildcard characters: False
188+
```
189+
190+
### -WhatIf
191+
The WhatIf switch simulates the actions of the command. You can use this switch to view the changes that would occur without actually applying those changes. You don't need to specify a value with this switch.
192+
193+
```yaml
194+
Type: SwitchParameter
195+
Parameter Sets: (All)
196+
Aliases: wi
197+
Applicable: Exchange Server 2013, Exchange Server 2016, Exchange Online
198+
Required: False
199+
Position: Named
200+
Default value: None
201+
Accept pipeline input: False
202+
Accept wildcard characters: False
203+
```
204+
205+
### CommonParameters
206+
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters (https://go.microsoft.com/fwlink/p/?LinkID=113216).
207+
208+
## INPUTS
209+
210+
###
211+
212+
## OUTPUTS
213+
214+
###
215+
216+
## NOTES
217+
218+
## RELATED LINKS
219+
220+
[Online Version](https://docs.microsoft.com/powershell/module/exchange/organization/new-applicationaccesspolicy)

0 commit comments

Comments
 (0)