Why the read-only app requests Exchange.ManageAsApp

The name of this permission suggests write access, and the consent screen does not explain its scope. This article explains why the permission is requested, why it does not give Attic write access to your Exchange Online environment, and how you can verify this yourself.

Rationale

Exchange Online does not offer a set of granular read-only application permissions the way Microsoft Graph does. There is no Exchange.Read.All that an app can consent to. Instead, Microsoft exposes a single permission, Exchange.ManageAsApp, which does only one thing: it allows an application to authenticate to Exchange Online PowerShell without a signed-in user.

Exchange.ManageAsApp grants authentication, not authorization. On its own it gives an app no access to any mailbox, policy, or configuration data. It is the key to the door, not permission to touch anything in the room.

What the app is actually allowed to do is decided entirely by the Entra ID directory roles assigned to the service principal in onboarding step 2. Attic assigns reader-level roles only:

• Global Reader — read all tenant configuration and settings
• Security Reader — read security data such as alerts, incidents, and policies
• Teams Reader — read Microsoft Teams configuration and settings

Because Global Reader is a read-only role, every Exchange Online cmdlet the app can reach through Exchange.ManageAsApp is a read cmdlet. Get-Mailbox, Get-OrganizationConfig, and Get-TransportRule succeed. Set-Mailbox, New-TransportRule, and every other write cmdlet are rejected by Exchange Online itself, because the service principal carries no role that permits them.

This is not an Attic interpretation. Microsoft documents the same mechanism in its app-only authentication guide:

The application object provisioned inside Microsoft Entra ID has a Directory Role assigned to it, which is returned in the access token. The session's role based access control (RBAC) is configured using the directory role information that's available in the token.

In that same article, under Option 1: Assign Microsoft Entra roles to the application, Microsoft lists the directory roles that are supported for app-only access to Exchange Online PowerShell. Global Reader is one of them, alongside privileged roles such as Exchange Administrator and Global Administrator. The session receives the permissions of whichever role is assigned, and no more. Attic uses the reader role from that list; the write-capable roles are the ones Attic does not assign.

This is also why the permission cannot simply be omitted. Without Exchange.ManageAsApp, Attic cannot connect to Exchange Online at all, and every Exchange-related check (mail flow, anti-phishing configuration, mailbox forwarding, audit settings) stops working.

Scope

The effective access is the intersection of the permission and the role:

The result is read-only. Raising the app to write access would require assigning a different directory role, such as Exchange Administrator, which Attic does not do during read-only onboarding.

Verifying this yourself

You can confirm the scope in your own tenant without contacting Attic:

1. Sign in to the Microsoft Entra admin center.
2. Navigate to Identity > Applications > Enterprise applications.
3. Search for [ATTIC] M365 RO and open it.
4. Under Security > Permissions, review the granted application permissions. All entries are read permissions, plus Exchange.ManageAsApp.
5. Under Roles and administrators, confirm that only Global Reader, Security Reader, and Teams Reader are assigned.

If any role other than a reader role is listed, the app is no longer read-only. Contact Attic if you see this.

Impact

• Attic can read your Exchange Online configuration and report on it.
• Attic cannot change mailboxes, mail flow rules, or Exchange policies through this app.
• Removing Exchange.ManageAsApp disables all Exchange Online checks; it does not make the remaining permissions safer, as they are already read-only.

More Information

• I've onboarded read-only but see a RW app too — explains the separate, temporary [ATTIC] M365 RW app that uses delegated permissions during onboarding to assign these roles, and whose access tokens are deleted afterwards.
• Manually onboard Attic read-only — assign the reader roles to the service principal yourself, without the RW app.
• Microsoft: App-only authentication for Exchange Online PowerShell — explains under How does it work? that the session's RBAC is configured from the directory role in the access token.
• Microsoft: Option 1 — Assign Microsoft Entra roles to the application — Microsoft's own list of supported roles for app-only Exchange Online access, including Global Reader.
• Microsoft: Global Reader role