Microsoft Graph API – Restricting Mail.Read access to a single mailbox
Posted: 03 Sep 2026, 06:35
Hello everyone,
I have developed a custom integration between MantisBT and Microsoft 365.
The integration works as follows:
Microsoft 365 mailbox
↓
Microsoft Graph API
↓
PHP script
↓
MantisBT REST API
↓
MantisBT ticket
When an email arrives in a specific mailbox, my PHP script reads the email using Microsoft Graph and automatically creates a ticket in MantisBT.
Currently, the Azure/Entra application has the following Microsoft Graph permission:
Mail.Read – Application
"Read mail in all mailboxes"
The integration works correctly, but I am concerned about the security implications of granting the application access to all mailboxes in the organization.
I only need the application to read emails from one specific mailbox used for MantisBT ticket creation.
Has anyone implemented a similar Microsoft Graph / Office 365 integration with MantisBT?
Is there a recommended way to restrict the application's Mail.Read permission so that it can only access a specific mailbox?
I am particularly interested in whether this can be handled through MantisBT itself, an existing MantisBT plugin, or if the restriction should be configured on the Microsoft 365 / Exchange Online side.
I have seen that Exchange Online supports Application RBAC for restricting application access to specific mailboxes.
Has anyone used Application RBAC with MantisBT and Microsoft Graph?
Are there any known compatibility issues with this approach?
Any advice or examples would be greatly appreciated.
Thank you!
I have developed a custom integration between MantisBT and Microsoft 365.
The integration works as follows:
Microsoft 365 mailbox
↓
Microsoft Graph API
↓
PHP script
↓
MantisBT REST API
↓
MantisBT ticket
When an email arrives in a specific mailbox, my PHP script reads the email using Microsoft Graph and automatically creates a ticket in MantisBT.
Currently, the Azure/Entra application has the following Microsoft Graph permission:
Mail.Read – Application
"Read mail in all mailboxes"
The integration works correctly, but I am concerned about the security implications of granting the application access to all mailboxes in the organization.
I only need the application to read emails from one specific mailbox used for MantisBT ticket creation.
Has anyone implemented a similar Microsoft Graph / Office 365 integration with MantisBT?
Is there a recommended way to restrict the application's Mail.Read permission so that it can only access a specific mailbox?
I am particularly interested in whether this can be handled through MantisBT itself, an existing MantisBT plugin, or if the restriction should be configured on the Microsoft 365 / Exchange Online side.
I have seen that Exchange Online supports Application RBAC for restricting application access to specific mailboxes.
Has anyone used Application RBAC with MantisBT and Microsoft Graph?
Are there any known compatibility issues with this approach?
Any advice or examples would be greatly appreciated.
Thank you!