Skip to main content

When to Use This

By default, Microsoft Graph application permissions grant access to all users in your tenant. Use Application Access Policies to restrict Parable’s access to a specific group of users.

​
Overview

This guide walks you through restricting your existing Microsoft 365 integration to only access data from a defined subset of users — such as a specific team or department.
Prerequisite: Complete the standard App Registration setup first. This guide adds restrictions to an existing app registration.

​
The Approach

You can’t limit permissions during token creation. Instead, you:
  1. Create a mail-enabled security group containing the users Parable should access
  2. Apply an Application Access Policy that restricts your app to only that group
Application Access Policies require PowerShell — this cannot be configured in the Azure portal.

​
Setup Guide

1

Create a Mail-Enabled Security Group

  1. Go to Microsoft 365 admin center or Entra ID portal
  2. Navigate to Groups → Active groups
  3. Click Add a group
  4. Select Mail-enabled security as the group type
FieldValue
NameParable-Access-Group
DescriptionUsers accessible by Parable integration
Email addressparable-access@yourdomain.com
A regular security group won’t work — it must be mail-enabled.
  1. Add the users you want Parable to access as members
2

Connect to Exchange Online PowerShell

Open PowerShell as administrator and run:
# Install the module (first time only)
Install-Module -Name ExchangeOnlineManagement

# Import and connect
Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline -UserPrincipalName your-admin@yourdomain.com
3

Create the Application Access Policy

Run this command, replacing the placeholder values:
New-ApplicationAccessPolicy `
  -AppId "YOUR_CLIENT_ID" `
  -PolicyScopeGroupId "parable-access@yourdomain.com" `
  -AccessRight RestrictAccess `
  -Description "Restricts Parable to specified user group"
ParameterValue
-AppIdYour app’s Client ID from Azure
-PolicyScopeGroupIdEmail address of your security group
-AccessRightRestrictAccess (enforces the limitation)
The policy can take up to 30 minutes to become fully active.
4

Verify the Policy

Test access for users inside and outside the group:
# Should return "Granted"
Test-ApplicationAccessPolicy `
  -Identity included.user@yourdomain.com `
  -AppId "YOUR_CLIENT_ID"

# Should return "Denied"
Test-ApplicationAccessPolicy `
  -Identity excluded.user@yourdomain.com `
  -AppId "YOUR_CLIENT_ID"