I was asked why the Outlook Mail API in Microsoft Graph cannot access group mailboxes. The main reason appears to be that a group mailbox is not associated with its own user account, while the Outlook Mail API is designed to work with mailboxes backed by an account. Given how group mailboxes are currently used, there may also be relatively little data or functionality that developers need to access through Graph. Is broader Graph support for group mailboxes actually a significant requirement?
3 Answers
Graph permissions can be very broad. For example, granting Mail.Send to an application may allow it to send as any mailbox in the tenant unless access is restricted. For mailbox-level control, Exchange Online RBAC for Applications is a better fit than relying only on broad Graph permissions.
Shared mailboxes and group mailboxes are different. Shared mailboxes are backed by an identity in Microsoft Entra ID, so Graph can access them. Group mailboxes do not have their own account, which is why the Outlook mail APIs do not currently treat them the same way.
That distinction explains why exporting a shared inbox through Graph works, but the same approach cannot be applied to a Microsoft 365 group mailbox.
The practical demand may be limited because group mailboxes are not full account-backed mailboxes. Most scenarios that involve importing, exporting, or programmatically processing mail are more likely to use shared mailboxes, which already have Graph support.
RBAC for Applications can limit the application to selected mailboxes, which addresses the tenant-wide access concern, although it still does not add support for group mailboxes.