Identity, Access Management and API Integrations
This domain tests the identity plane that gates the mail service: how users authenticate, how administrators are constrained, and how applications obtain mailbox access without a human. Questions are usually about blast radius - what a misconfigured grant or exclusion actually permits.
Authentication models
Cloud-only identities authenticate in the tenant. Hybrid identities use password hash sync, pass-through authentication, or federation; the choice determines outage behaviour if on-premises infrastructure fails. Legacy protocols (basic SMTP AUTH, older IMAP/POP clients) bypass modern controls and are disabled by default in current tenants; SMTP AUTH must be enabled per mailbox, not tenant-wide.
Conditional Access
Signals - user or group, application, location, device compliance, sign-in risk - feed a decision with controls such as MFA, compliant device, app protection policy, authentication strength, or block. Service accounts are the usual hole: an exclusion created for a scanner years ago often persists with no owner.
Administrative RBAC
Least privilege means role groups scoped to tasks, admin units to limit scope to a subset of users, and just-in-time elevation with approval rather than standing global admin. Every standing assignment is a credential an attacker wants.
Applications and APIs
- Delegated permissions act as the signed-in user; application permissions act as the app itself, with no user present.
- Client-credential flows need application permissions - a delegated grant will not work.
- Application access policies restrict app-only mailbox access to a mail-enabled security group, converting a tenant-wide grant into a scoped one.
- Prefer certificates over client secrets, set expiry, and review admin consent grants.
Worked example
An archive vendor needs to read 200 of 4,000 mailboxes. Register the app, request the application-scoped mail-read permission, obtain admin consent, then create an application access policy scoped to a mail-enabled security group containing those 200 users, and verify with the policy test cmdlet. Reasoning: consent alone grants tenant-wide reach; the access policy is what actually bounds the blast radius if the vendor's certificate leaks.
Traps
- Re-enabling SMTP AUTH tenant-wide to fix one multifunction device.
- Stale Conditional Access exclusions for service accounts.
- Secrets with no expiry or owner.
- Confusing delegated and application permission behaviour.
- Guest invitations that are later granted administrative roles.