Exchange Online Application Access Policies: Constraining Graph Application Permissions to Specific Mailboxes
Application permissions grant tenant-wide access by default. Exchange Online Application Access Policies let you scope Graph Mail.Read to a mail-enabled security group, enforcing least privilege for daemon services.