This guide is for Microsoft 365 Global Administrators or Privileged Role Administrators who’ve followed our Microsoft 365 Direct Message Injection (DMI) Setup Guide to configure our Microsoft DMI feature.

This document provides some optional steps to scope the Mail.ReadWrite permissions you granted MetaCompliance to specific mailboxes.

This helps customers who only plan to send simulated phishing emails to a subset of their users reduce the scope of the permissions granted to MetaCompliance.

What you will need

• Global Administrator or Privileged Role Administrator access to your Microsoft 365 tenant
• Access to Exchange Online PowerShell for the mailbox scoping step

Scope access to relevant mailboxes

There is currently no option to do this through the Microsoft 365 or Entra portals — it requires a few short PowerShell commands. The steps below take you through this from scratch, with no prior PowerShell experience assumed.

1 – Install the Exchange Online PowerShell module (one-time)

Open PowerShell as an administrator and run:

Install-Module -Name ExchangeOnlineManagement -Repository PSGallery -Force

If you're prompted to trust the repository, type Y and press Enter.

2 – Connect to Exchange Online

Connect-ExchangeOnline -Organization "yourtenant.onmicrosoft.com"

Replace yourtenant.onmicrosoft.com with your own tenant domain. This will open a sign-in window — sign in with your Global Administrator or Privileged Role Administrator account.

3 – Create a mail-enabled security group

This group will define exactly which mailboxes MetaCompliance is allowed to access. You'll add your approved mailboxes to this group in the next step.

New-DistributionGroup -Name "MetaComplianceApprovedMailboxes" -Type "Security"

Feel free to rename the group, but make a note of whatever name you choose — you'll need it in the next two steps.

4 – Add your approved mailboxes to the group

This is the key step that determines which mailboxes MetaCompliance can access. Only mailboxes added to this group will be reachable by the MetaCompliance app — every other mailbox in your tenant will be out of scope.

Run the following once for each mailbox you want to approve:

Add-DistributionGroupMember -Identity "MetaComplianceApprovedMailboxes" -Member "user@yourdomain.com"

Repeat this command for every additional mailbox, changing the email address each time.

5 – Create the Application Access Policy

This final command tells Exchange Online to restrict the MetaCompliance app so it can only access mailboxes belonging to the group you just created.

New-ApplicationAccessPolicy `
    -AppId "cbdecc5a-583e-4f3a-b146-64dcec655462" `
    -PolicyScopeGroupId "MetaComplianceApprovedMailboxes@yourtenant.onmicrosoft.com" `
    -AccessRight RestrictAccess `
    -Description "Restrict MetaCompliance app to approved mailboxes only"

6 – Confirm the policy is working

You can check whether a specific mailbox is correctly in scope at any time:

Test-ApplicationAccessPolicy -AppId "cbdecc5a-583e-4f3a-b146-64dcec655462" -Identity "user@yourdomain.com"

This should return AccessCheckResult: Granted for any mailbox you've added to the group, and Denied for any mailbox you haven't.

Note: Changes made in Steps 4 and 5 can take up to 30 minutes (occasionally longer) to fully take effect across Exchange Online. If a check doesn't return the expected result immediately, wait a short while and try again before contacting support.