AegisAI Perspectives · 006
Grant one scoped read permission to a named pilot group, write pass criteria and an end date first, verify the scope, then revoke and delete on that date.
Grant one read permission, scope it to a named pilot group, write the pass criteria and end date before consent, then revoke on that date. Exchange Online app permission changes take 30 minutes to 2 hours to apply1.
A read-only proof of concept (PoC) gives a new email security tool only a read role, such as Application Mail.Read, which allows reading email in all mailboxes4. The structure below covers Microsoft 365 and Google Workspace. It assumes the tool connects through the platform API, so no MX record changes. If you are still choosing a deployment model, start with whether API-based email security needs an MX record change.
The permission does. Microsoft documents Application Mail.Read as reading email in all mailboxes. Application Mail.ReadBasic reads email in all mailboxes without a signed-in user, except the body, preview, attachments and extended properties.
Microsoft's own guidance is to request the least privileged permission the app needs5. The Canadian Centre for Cyber Security says the same for cloud email: use the cloud service's own access management tools to enforce least privilege23.
On Google Workspace, gmail.readonly lets an app view messages and settings18. The gmail.metadata scope shows labels and headers but not the body19. Google lists both as restricted scopes.
IANS advises granting access only for the limited period the PoC needs and including full deletion of data once it ends24. For pass criteria that survive a vendor demo, use how to run a fair proof of value against a vendor's claims.
Mail.ReadBasic covers mail without the body, preview, attachments or extended properties, so body and attachment analysis needs Mail.Read. On Google, gmail.metadata excludes the body and gmail.readonly views messages.
Reviewers can view, block or deny a request, but only a Global Administrator approves Microsoft Graph application permissions7. The workflow takes up to an hour to switch on after you save it6. Set "Consent request expires after (days)" to fix how long a request stays valid8.
Use resource scoping in Exchange Online RBAC so the Application Mail.Read role covers only the pilot mailboxes. Then remove the unscoped Mail.Read grant in Entra ID: Exchange adds the two grants together, and an unscoped Entra grant cancels the scope2.
Run Test-ServicePrincipalAuthorization against one mailbox inside the pilot and one outside it. InScope should read true, then false3. The test skips the 30 minute to 2 hour cache. It excludes permissions granted in Entra ID, so also open the app's Admin consent tab in Entra ID and revoke any Mail.Read listed there.
With domain-wide delegation the app reaches the data of all users20. Add only the scope from step 2, and write the pilot list into the PoC agreement. Google asks admins to keep each scope narrow and review service accounts22.
Message trace searches up to 90 days of history, 10 days per query15. Ranges over 10 days return only a downloadable CSV prepared from archived data, and Microsoft warns that report takes several hours in some cases16. Export a summary every week, not once on the last day.
In Entra ID, revoke the admin consent permissions from the app's Admin consent tab. Revoking does not stop a re-consent11, so delete the service principal or block consent too. On Google, delete the delegation client; apps that depend on it stop working at once21. Then ask for written confirmation of data deletion.
| Platform | Permission or scope | What the app reads | How to limit it to the pilot | How to remove it |
|---|---|---|---|---|
| Microsoft 365 | Application Mail.ReadBasic | Mail without body, preview, attachments or extended properties | Resource scoping in Exchange Online RBAC | Revoke in the Admin consent tab |
| Microsoft 365 | Application Mail.Read | Email, including the parts Mail.ReadBasic excludes | Same, with the Entra grant removed | Revoke, then block re-consent |
| Google Workspace | gmail.metadata | Labels and headers, no body | Pilot list in the PoC agreement; delegation reaches all users | Delete the delegation client |
| Google Workspace | gmail.readonly | Messages and settings | Same as above | Delete the client, review service accounts |
Illustrative example, figures are fictional. A 1,400 mailbox Microsoft 365 tenant scopes Application Mail.Read to a 120 mailbox administrative unit: finance, executives and the service desk. The Global Administrator approves the request on day 0. Test-ServicePrincipalAuthorization shows InScope true for a finance mailbox and false for a marketing mailbox. On day 9 the tool flags 14 delivered messages; message trace confirms 11 reached inboxes, and the security team deletes them by hand because the PoC cannot. On day 30 the team revokes consent, deletes the service principal and files the vendor's deletion letter.
The example shows why a read-only PoC needs a manual removal path: Mail.Read and Mail.ReadBasic allow the tool to read email, and the team removes what it flags.
Track three numbers, each from a log you own rather than the vendor's dashboard.
No. Application Mail.Read and Mail.ReadBasic are roles that allow an app to read email. Name who deletes confirmed threats by hand during the PoC, and how fast, before the tool starts flagging messages.
Only if the test is about headers and senders. Mail.ReadBasic excludes the body, preview, attachments and extended properties, so content-based detection of phishing text or payloads needs Mail.Read.
Between 30 minutes and 2 hours, depending on how recently the app called the API. Test-ServicePrincipalAuthorization bypasses that cache, so run it to check the new scope without waiting for the app to pick it up.
Not through delegation. Domain-wide delegation gives the app access to the data of all users. Limit what it reads instead: gmail.metadata excludes the body. Write the pilot list into the agreement, and edits to delegation can take up to a day to apply.
A Global Administrator. Reviewers in the admin consent workflow can view, block or deny the request, but only a Global Administrator approves application permissions for Microsoft Graph.
Agree on full deletion of data at the end before access starts, as IANS advises for third-party PoCs. On the end date, revoke the grant, delete the service principal or delegation client, and keep the vendor's written deletion confirmation with the PoC record.
