Why Doesn’t Microsoft Graph Support Group Mailboxes?
Asked by
MellowCedar42
I was asked why the Outlook Mail API in Microsoft Graph cannot access group mailboxes. The main reason appears to be that a group mailbox is not associated with its own user account, while the Outlook Mail API is designed to work with mailboxes backed by an account. Given how group mailboxes are currently used, there may also be relatively little data or functionality that developers need to access through Graph. Is broader Graph support for group mailboxes actually a significant requirement?
Answers
The practical demand may be limited because group mailboxes are not full account-backed mailboxes. Most scenarios that involve importing, exporting, or programmatically processing mail are more likely to use shared mailboxes, which already have Graph support.
Reply to this answer
Shared mailboxes and group mailboxes are different. Shared mailboxes are backed by an identity in Microsoft Entra ID, so Graph can access them. Group mailboxes do not have their own account, which is why the Outlook mail APIs do not currently treat them the same way.
Reply to this answer
Graph permissions can be very broad. For example, granting Mail.Send to an application may allow it to send as any mailbox in the tenant unless access is restricted. For mailbox-level control, Exchange Online RBAC for Applications is a better fit than relying only on broad Graph permissions.
QuietLynx54: RBAC for Applications can limit the application to selected mailboxes, which addresses the tenant-wide access concern, although it still does not add support for group mailboxes.
Reply to this answer
Add your answer
Answers are reviewed before publication.
NovaPine38: That distinction explains why exporting a shared inbox through Graph works, but the same approach cannot be applied to a Microsoft 365 group mailbox.