title: Microsoft Graph Service/Daemon Access Specific Shared Mailbox
body: <p>I have an app that queries Microsoft Graph, and it must run as a service/daemon. This app needs to access one specific shared mailbox. The app must not have access to the entire tenant (which I believe is the behavior with 'Grant Admin Consent'). How would I go about granting permission to a service/daemon to one specific shared mailbox?</p>
  
  <p>I have seen this documentation:</p>
  
  <p><a href="https://docs.microsoft.com/en-us/graph/auth-limit-mailbox-access" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/graph/auth-limit-mailbox-access</a></p>
  
  <p><a href="https://docs.microsoft.com/en-us/powershell/module/exchange/organization/new-applicationaccesspolicy?view=exchange-ps" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/powershell/module/exchange/organization/new-applicationaccesspolicy?view=exchange-ps</a></p>
  
  <p>I have tried the cmdlet "New-ApplicationAccessPolicy" but the target of the -PolicyGroupId is the shared mailbox, which returns an error because it's not a security principal. </p>