Skip to main content
  • Setup
  • Reference

When to Use This

By default, Microsoft Graph application permissions grant access to all users in your tenant. Use Application Access Policies to restrict Parable’s access to a specific group of users.

​
Overview

This guide walks you through restricting your existing Microsoft 365 integration to only access data from a defined subset of users — such as a specific team or department.
Prerequisite: Complete the standard App Registration setup first. This guide adds restrictions to an existing app registration.

​
The Approach

You can’t limit permissions during token creation. Instead, you:
  1. Create a mail-enabled security group containing the users Parable should access
  2. Apply an Application Access Policy that restricts your app to only that group
Application Access Policies require PowerShell — this cannot be configured in the Azure portal.

​
Setup Guide

1

Create a Mail-Enabled Security Group

  1. Go to Microsoft 365 admin center or Entra ID portal
  2. Navigate to Groups → Active groups
  3. Click Add a group
  4. Select Mail-enabled security as the group type
FieldValue
NameParable-Access-Group
DescriptionUsers accessible by Parable integration
Email addressparable-access@yourdomain.com
A regular security group won’t work — it must be mail-enabled.
  1. Add the users you want Parable to access as members
2

Connect to Exchange Online PowerShell

Open PowerShell as administrator and run:
# Install the module (first time only)
Install-Module -Name ExchangeOnlineManagement

# Import and connect
Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline -UserPrincipalName your-admin@yourdomain.com
3

Create the Application Access Policy

Run this command, replacing the placeholder values:
New-ApplicationAccessPolicy `
  -AppId "YOUR_CLIENT_ID" `
  -PolicyScopeGroupId "parable-access@yourdomain.com" `
  -AccessRight RestrictAccess `
  -Description "Restricts Parable to specified user group"
ParameterValue
-AppIdYour app’s Client ID from Azure
-PolicyScopeGroupIdEmail address of your security group
-AccessRightRestrictAccess (enforces the limitation)
The policy can take up to 30 minutes to become fully active.
4

Verify the Policy

Test access for users inside and outside the group:
# Should return "Granted"
Test-ApplicationAccessPolicy `
  -Identity included.user@yourdomain.com `
  -AppId "YOUR_CLIENT_ID"

# Should return "Denied"
Test-ApplicationAccessPolicy `
  -Identity excluded.user@yourdomain.com `
  -AppId "YOUR_CLIENT_ID"