Restrict what Tekst can do in your mailboxes

An organization-wide Outlook account gives Tekst application-level access, which by default can both read and write in the mailboxes it reaches. This guide explains how an administrator can narrow that to read-only access, or to mailbox settings only.

This is the companion to Restrict Tekst to specific mailboxes. That guide limits which mailboxes Tekst can reach; this one limits what Tekst may do in them. The two work together, and we recommend applying both.

This applies to organization-wide accounts only. A personal account is limited by the permissions its signed-in user consented to, so you choose its access when you connect it.

Which restriction do you need

Choose the narrowest option that still supports what you use Tekst for. If you are unsure which automations would be affected, ask your Tekst contact before you apply a restriction.

How the restriction works

Microsoft lets you control an application's access to Exchange Online with Role Based Access Control (RBAC) for Applications. You assign the Tekst application a role, such as Application Mail.Read, and Exchange then allows only what that role covers. The effective access is the narrower of the two: what Tekst was granted in Microsoft Entra ID, and what your role assignment allows.

Two things worth knowing before you start:

• The restriction lives in your tenant, so you stay in control of it. Removing the role assignment returns Tekst to its default access.
• The permissions recorded on the Tekst application in Entra ID do not change. What changes is what Exchange lets Tekst do with them.

Prerequisites

• Administrator access to your Microsoft 365 and Exchange Online environment.
• The Exchange Online PowerShell module installed.
• The Application (client) ID of the Tekst Outlook application: b2094c09-0651-49c4-b2c2-ed3b739e2a8c.
• The Object ID of the Tekst enterprise application in your tenant. Find it under Microsoft Entra ID > Enterprise applications > Outlook x Tekst.
• Optionally, a mail-enabled security group holding the mailboxes the restriction should apply to, if you also want to limit which mailboxes Tekst reaches.

Step 1: Connect to Exchange Online PowerShell

Connect-ExchangeOnline

For details, see Microsoft's guide on how to connect to Exchange Online PowerShell.

Step 2: Register the Tekst application in Exchange

Exchange keeps its own record of the applications it knows about, so register the Tekst application once before assigning it a role:

New-ServicePrincipal `
    -AppId b2094c09-0651-49c4-b2c2-ed3b739e2a8c `
    -ObjectId <object-id-of-the-enterprise-application> `
    -DisplayName "Tekst"

If the service principal already exists, Exchange reports that and you can continue to the next step.

Step 3: Assign the role you want

Assign the role that matches the access you chose. For read-only access:

New-ManagementRoleAssignment `
    -App b2094c09-0651-49c4-b2c2-ed3b739e2a8c `
    -Role "Application Mail.Read" `
    -Name "Tekst read-only mail"

For mailbox settings only, assign Application MailboxSettings.Read instead of Application Mail.Read.

To limit the assignment to a group of mailboxes rather than the whole tenant, create a scope first:

New-ManagementScope `
    -Name "Tekst mailboxes" `
    -RecipientRestrictionFilter "MemberOfGroup -eq '<distinguished-name-of-your-group>'"

Then reference that scope when you assign the role:

New-ManagementRoleAssignment `
    -App b2094c09-0651-49c4-b2c2-ed3b739e2a8c `
    -Role "Application Mail.Read" `
    -CustomResourceScope "Tekst mailboxes" `
    -Name "Tekst read-only mail"

Assign only the roles you want Tekst to have. Any Exchange role you do not assign is access Tekst does not get.

Step 4: Verify the restriction

Check what Tekst is authorized to do:

Test-ServicePrincipalAuthorization `
    -Identity b2094c09-0651-49c4-b2c2-ed3b739e2a8c

The output lists the roles in effect. Test with a mailbox inside your scope and one outside it to confirm the result matches what you intended.

Role assignments can take up to 30 minutes to take effect. If a change does not seem to apply straight away, wait and test again.

Step 5: Tell Tekst about the restriction

Tekst cannot detect your restriction on its own. Microsoft answers a restricted application exactly like an unrestricted one until a request is refused, so Tekst needs to be told what to expect.

This step is required if you chose mailbox settings only. Without it, Tekst keeps trying to read email in these mailboxes, and reports them as unhealthy when Microsoft refuses.

1. In Tekst, open Integrations and select your organization-wide Outlook account.
2. Open the Settings tab.
3. Set Mailbox access to Mailbox settings only.
4. Save your changes.

Leave Mailbox access on Full mailbox access if you chose read-only access, since Tekst still reads email in that case.

Changing the restriction later

Tightening or relaxing the restriction is a change to your role assignment, not to the connection in Tekst. Adjust the assignment in Exchange Online PowerShell and the new access applies to Tekst's next request. Nothing has to be reconnected, no consent has to be granted again, and the mailboxes, folder settings, and history on the integration are all preserved.

If you relax a mailbox-settings-only restriction so that Tekst can read email again, remember to set Mailbox access back to Full mailbox access so those mailboxes resume syncing.

Troubleshooting

Tekst reports mailboxes as unhealthy after a restriction

Check that Mailbox access in the Settings tab matches the restriction you applied. A mailbox-settings-only restriction with Tekst still set to full access produces exactly this result.

The restriction does not seem to apply

Role assignments can take up to 30 minutes to propagate. If an existing application access policy is also in place for the Tekst application, review both: Microsoft is gradually replacing application access policies with RBAC for Applications, and running both models at once makes the effective access harder to reason about.

Reference

This guide is based on Microsoft's documentation on role based access control for applications in Exchange Online.