Exchange Online via Restricted EWS Application (RBAC Scoping)

An alternative way to connect to Exchange Online using scoped RBAC permissions instead of granting organization-wide mailbox access.

Overview

Movebot supports connecting to Exchange Online using a restricted application configuration that limits mailbox access to a defined subset of mailboxes within the tenant.

This method introduces additional configuration complexity and is not recommended unless mailbox-level access restriction is required.

We recommend only administrators familiar with Exchange Online PowerShell and RBAC perform this setup. Contact support before proceeding if unsure.

When should this be used instead of full access?

If you require:

• Restricting mailbox access to a defined subset of users

• Compliance controls preventing tenant-wide mailbox access

If you are not subject to the above requirements, follow the standard Exchange Online guide.

Requirements

To configure this connection method, you will need:

• A Movebot account

• An Exchange Online administrator account

• Access to Microsoft Entra ID

• PowerShell access to Exchange Online

How to Configure Restricted EWS Access

1. Create the application registration in Entra

   • Login to Entra as an administrator for your domain, and navigate to App Registrations.

   • Click New Registration

   • Specify a name for the new application. Leave the remaining fields as default. Click Register.

   • Make a note of the Application (Client) ID. This will be entered into your Movebot configuration.

   • Make a note of the Tenant ID. This will be needed in Movebot

   • Configure the permissions. Click API Permissions --> Add a Permission.

   • Select APIs my organisation uses, then search for Office 365 Exchange Online.

   • Select Application Permissions

   • Enable permission:

     Exchange.ManageAsAppV2

   • Grant admin consent

   • Click Certificates and Secrets --> Client Secrets --> New Client Secret

   • Copy the Client Secret Value

2. Configure the Connection in Movebot

   The following information is must be entered into the Movebot EWS connector.

   • Tenant ID

   • Email Address (does not need to be an administrator account.)

   • Application Client ID

   • Application Client Secret

3. Connect to Exchange Online using PowerShell

   Connect-ExchangeOnline

4. Create a Mail-Enabled Security Group

   • Create a group that defines which mailboxes Movebot can access.

     New-DistributionGroup -Name "EWS-App-Allowed-Mailboxes" -Type Security

   • Add allowed mailboxes:

     Add-DistributionGroupMember -Identity "EWS-App-Allowed-Mailboxes" -Member [email protected]

   • Only mailboxes added to this group will be accessible.

5. Retrieve the Distinguished Name of Security Group

   Get-DistributionGroup "EWS-App-Allowed-Mailboxes" | Select DistinguishedName

   • Copy the entire DistinguishedName value.

   • Example:

   CN=EWS-App-Allowed-Mailboxes,OU=contoso.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=AUSP913A004,DC=PROD,DC=OUTLOOK,DC=COM

6. Create the Management Scope

   New-ManagementScope -Name "User Mailboxes" `
   -RecipientRestrictionFilter "MemberOfGroup -eq 'FULL-DN-HERE'"

   • Replace FULL-DN-HERE with your group’s Distinguished Name.

7. Register the Service Principal

   • You will need:

     • Application ID (from App Registration)

     • Object ID (from Enterprise Application)

     New-ServicePrincipal `
     -AppId <ApplicationID> `
     -ObjectId <EnterpriseAppObjectID> `
     -DisplayName "Movebot-Restricted"

8. Assign the EWS RBAC Role with Scope

   • New-ManagementRoleAssignment `
     -App <EnterpriseAppObjectID> `
     -Role "Application EWS.AccessAsApp" `
     -CustomResourceScope "User Mailboxes"

9. Validate the Configuration

   • To confirm whether a mailbox is within scope:

   Test-ServicePrincipalAuthorization `
   -Identity <ApplicationID> `
   -Resource [email protected]

   • If the result shows: InScope = True the mailbox is accessible.

Important Notes

Connection Test Behaviour

When using restricted RBAC scoping, the Movebot connection test will fail by design.

This is expected behaviour and does not indicate a misconfiguration.

Because the application does not have organization-wide access, automatic mailbox discovery and validation are not supported.

Permission Propagation Delay

Permission updates and RBAC scope changes may not take effect immediately. In some environments, it can take up to an hour before access behaviour reflects the new configuration. If testing fails immediately after setup, wait and retry before troubleshooting further.

Mailbox Mapping Requirement

When using restricted access:

• Mailboxes must be mapped manually using CSV Transfer Mapping.

• Only mailboxes included in the mail-enabled security group can be migrated.

• Mailboxes outside of the group will return HTTP 403 errors during migration.

Common Errors

Error: 403 Forbidden

Cause: Mailbox is not a member of the mail-enabled security group used in the management scope.

Fix: Add the mailbox to the group and retry the migration.

Supported Features

Movebot supports Exchange Online mailbox migrations using this configuration.

Feature	Supported
Mailbox Migration	Fully Supported
Shared Mailboxes	Fully Supported
Archive Mailboxes	Fully Supported
Calendar	Fully Supported
Contacts	Fully Supported