Restrict Tekst to specific mailboxes

When you connect an organization-wide Outlook account, Tekst is granted application-level access that can reach every mailbox in your tenant by default. This guide explains how an administrator can restrict that access to only the mailboxes that are relevant for Tekst.

This guide limits which mailboxes Tekst can reach. It does not change what Tekst may do inside them: in the mailboxes it can still reach, Tekst keeps its default read and write access. Narrowing that as well, so Tekst can read without sending or without changing email, is a separate restriction, covered in Microsoft Graph permissions Tekst requests and how to restrict them.

This applies to organization-wide accounts only. A personal account is already limited to the mailboxes its signed-in user can reach, so no extra scoping is needed.

Connect the organization-wide account in Tekst first, then scope it. Tekst's application only appears in your tenant, under Microsoft Entra > Enterprise applications, once an administrator has granted consent during that connection.

How scoping works

Microsoft lets you limit an application's mailbox access with an application access policy. The policy ties Tekst's application to a mail-enabled security group: Tekst can then access the mailboxes that are members of the group, and no others.

Note that application access policies are a long-standing Exchange Online feature that Microsoft is gradually replacing with Role Based Access Control (RBAC) for Applications. The steps below still work today; if your organization has standardized on App RBAC, you can scope the same application using that newer model instead.

Prerequisites

• Administrator access to your Microsoft 365 / Exchange Online environment.
• PowerShell with the Exchange Online module (ExchangeOnlineManagement). No Windows machine is needed: on macOS or Linux, install PowerShell 7 first, then run Install-Module ExchangeOnlineManagement.
• A mail-enabled security group containing the mailboxes Tekst should access.

Step 1: Connect to Exchange Online PowerShell

Open PowerShell and connect to Exchange Online:

Connect-ExchangeOnline

For details, see Microsoft's guide on how to connect to Exchange Online PowerShell.

Step 2: Identify the app client ID and security group

You will need the following:

• Application (client) ID of the Tekst Outlook application: b2094c09-0651-49c4-b2c2-ed3b739e2a8c. This ID is the same in every tenant. To confirm it, open Enterprise applications in Microsoft Entra, search for Outlook x Tekst (service account) and check that its Application ID reads b2094c09. Match on the ID, not the name. A policy on any other application, whatever it is called, has no effect on Tekst, and the test step will still report Granted for Tekst's ID. If you connected with your own app registration, use that app's Application (client) ID instead, here and in the commands below.
• Mail-enabled security group: create a new mail-enabled security group or use an existing one, and add only the mailboxes Tekst should access. All other mailboxes in the tenant will be excluded. Note the group's email address to use as the PolicyScopeGroupId. In the Exchange admin center, the Add a group wizard opens on the Microsoft 365 tab. Switch to Mail-enabled security before you create the group: the policy command rejects a Microsoft 365 group. Use the group's email address in the commands. Exchange may add a timestamp to the group's Name, but the address stays as you typed it.

Because the group is mail-enabled, email sent to its address is delivered to every mailbox Tekst works in. Hide it and restrict who can send to it, as described in "Keep the group from receiving email" in the appendix below.

Step 3: Create the application access policy

Run the following, replacing the group address with your security group and adjusting the description:

New-ApplicationAccessPolicy `
    -AppId b2094c09-0651-49c4-b2c2-ed3b739e2a8c `
    -PolicyScopeGroupId <your-group@yourdomain.com> `
    -AccessRight RestrictAccess `
    -Description "Restrict Tekst app to members of the security group"

Step 4: Test the application access policy

Verify the policy by testing it against specific mailboxes:

Test-ApplicationAccessPolicy `
    -Identity <user@yourdomain.com> `
    -AppId b2094c09-0651-49c4-b2c2-ed3b739e2a8c

The output indicates whether the app has access to that mailbox. Test with a user inside the group and a user outside it to confirm the policy behaves as expected.

Troubleshooting

"Couldn't be found" when you list policies

On a tenant with no application access policy yet, Get-ApplicationAccessPolicy fails with "The operation couldn't be performed because object '...' couldn't be found". That is the normal "no policies yet" answer. Once you create the first policy, the command lists it.

Policy not taking effect

Test-ApplicationAccessPolicy reflects a change at once, but Microsoft Graph, and so Tekst, follows later. Allow up to 2 hours. While you wait, the test can say Granted while Tekst still shows the mailbox as Disconnected. That is the same delay, not a second problem.

Module version errors

On macOS and Linux, the current Exchange Online module needs PowerShell 7.6 or later. Check your version:

$PSVersionTable.PSVersion

What Tekst shows when a mailbox is out of scope

A connected mailbox that is not in the group shows as Disconnected in Tekst, and Verify connection on the Advanced tab answers "Integration is not healthy - please check your credentials". The credentials are fine: the policy is doing its job. Add the mailbox to the group and allow for the delay above. Mailboxes in the group keep working throughout.

Assignment required and Users and groups on the Tekst application in Microsoft Entra do not limit which mailboxes Tekst can reach. Only the application access policy does.

Reference

This guide is based on Microsoft's documentation on limiting application permissions to specific mailboxes.

Appendix: maintain the list with a security group

A group is optional. The policy can point straight at a single mailbox, and for one mailbox that is the shortest path. A mail-enabled security group is worth the extra step when Tekst should reach several mailboxes, or when that set will change over time: the policy is created once, and from then on the group membership is the only thing you edit.

Create the group

The policy can only point at a security principal, which for a group means a mail-enabled security group. Distribution groups, Microsoft 365 Groups, and dynamic distribution groups are not accepted. If you are unsure what an existing group is, check it:

Get-Recipient -Identity tekst-mailboxes@yourdomain.com |
    Select-Object RecipientTypeDetails, IsValidSecurityPrincipal

RecipientTypeDetails should read MailUniversalSecurityGroup and IsValidSecurityPrincipal should be True.

Create a new group in the Exchange admin center under Recipients > Groups > Add a group > Mail-enabled security, or from PowerShell:

New-DistributionGroup `
    -Name "Tekst mailboxes" `
    -Type Security `
    -PrimarySmtpAddress tekst-mailboxes@yourdomain.com

Then add the mailboxes Tekst should be able to reach:

Add-DistributionGroupMember `
    -Identity tekst-mailboxes@yourdomain.com `
    -Member orders@yourdomain.com

A shared mailbox cannot scope a policy on its own, but it can be a member of the group. Since shared mailboxes are usually the reason to connect Tekst, this is how you bring them in scope.

Use the group's email address as the PolicyScopeGroupId in Step 3.

Keep the group from receiving email

A mail-enabled security group is also a working distribution list. It has an email address, it shows up in your organization's address book, and every message sent to it is delivered to all of its members. Here, those members are the mailboxes Tekst works in. If someone picks the group from the address suggestions by mistake, every connected mailbox receives the message, and replies to all can quickly multiply.

Tekst only uses the group's membership, never its email address. Hide the group and allow only an administrator to send to it. In the Exchange admin center, open the group, and on Settings tick Hide this group from the global address list and select Save, then use Edit delivery management to limit who can send to it. Or run:

Set-DistributionGroup `
    -Identity tekst-mailboxes@yourdomain.com `
    -HiddenFromAddressListsEnabled $true `
    -RequireSenderAuthenticationEnabled $true `
    -AcceptMessagesOnlyFromSendersOrMembers admin@yourdomain.com

• HiddenFromAddressListsEnabled removes the group from the address book, so it is no longer suggested when people type a name. Outlook can take a while to pick up the change, and a user who already sent to the group may still see it in their own suggestions until they remove it there.
• RequireSenderAuthenticationEnabled rejects email from outside your organization. This is already the default for groups created with New-DistributionGroup, so setting it again only guards against a later change.
• AcceptMessagesOnlyFromSendersOrMembers rejects email from anyone except the senders you list. Replace admin@yourdomain.com with an administrator mailbox. Anyone else who writes to the group gets a delivery failure instead of reaching every connected mailbox.

If you created the group before reading this, run the command now. The application access policy only looks at who is a member of the group, so these settings do not change which mailboxes Tekst can reach. To confirm, re-run the test from Step 4 afterwards.

Maintain the list

Once the policy exists, you do not run New-ApplicationAccessPolicy again. Onboarding and offboarding a mailbox is a change to the group, either on its Members tab in the Exchange admin center or from PowerShell:

# Bring a mailbox in scope
Add-DistributionGroupMember `
    -Identity tekst-mailboxes@yourdomain.com `
    -Member invoices@yourdomain.com

# Take a mailbox out of scope
Remove-DistributionGroupMember `
    -Identity tekst-mailboxes@yourdomain.com `
    -Member old-inbox@yourdomain.com

# See what is currently in scope
Get-DistributionGroupMember -Identity tekst-mailboxes@yourdomain.com

A membership change takes the same time as the policy itself: the test from Step 4 reflects it at once, and Tekst follows within up to 2 hours. To confirm a mailbox is back, use Verify connection in Tekst, not the test alone.

Add a mailbox to the group before you connect it in Tekst. A mailbox that is connected in Tekst but missing from the group shows as Disconnected, which is covered in Add shared and child mailboxes.