Understand the Security Implications of Application Authentication for Outlook Mail, OneDrive, and SharePoint Modules

From Lasernet Core 11.2, the Outlook Mail, OneDrive, and SharePoint modules only support application authentication. Delegated (user) authentication is no longer available. This applies to the SharePoint Output module's Graph connection only; its separate Legacy connection is unaffected. If your configuration previously used delegated authentication, switching to application authentication changes what the module's credentials can access. Your Entra ID administrator should understand this before granting permissions.

Affected Modules

If your Lasernet Core configuration contains any of the modules listed below, application authentication is now the only supported option, and the security implications described in this article apply:

• Input

  • OneDrive Input

  • Outlook Mail Input

• Output

  • OneDrive Output

  • Outlook Mail Output

  • SharePoint Output (only if the module's connection uses the Graph REST API and application authentication; modules using the Legacy REST API are not affected)

If you are also migrating from Lasernet Core 10.12.1 or earlier, you may need to complete a separate, unrelated app registration update first; see Make Mandatory Configuration Updates Due to OneDrive, Outlook Mail, and SharePoint Module Changes.

Delegated vs. Application Authentication

Delegated (User) Authentication

The module acts as a specific signed-in user. Its effective access is limited to what that user can personally see: their mailbox, their OneDrive, and the SharePoint sites they have access to. This is true even if the app itself has been granted broader permissions.

Application Authentication

The module acts as the app itself. Its effective access is defined only by the permissions granted to the app registration in Entra ID. The permissions of the signed-in user are not taken into account. For the permissions these modules require, that access extends to every relevant resource in the tenant unless an administrator deliberately narrows the scope (see Reducing the Scope of Access below).

A compromised or over-scoped delegated token exposes one user's data. A compromised or over-scoped application credential (client secret or certificate) can expose the equivalent resource across the entire tenant.

Permissions Required by Each Module

Reducing the Scope of Access

Microsoft provides mechanisms to narrow application-only access down from "every resource in the tenant" to only what a given Lasernet Core configuration actually needs.

Outlook Mail

The current Microsoft-recommended mechanism is Role Based Access Control (RBAC) for Applications in Exchange Online. An Exchange administrator assigns a scoped application role (for example, Application Mail.ReadWrite or Application Mail.Send) that is restricted to a specific mailbox, a management scope, or an admin unit, instead of granting consent to Mail.ReadWrite/Mail.Send tenant-wide in Entra ID.

Note

The older Application Access Policies mechanism (New-ApplicationAccessPolicy, scoping to a mail-enabled security group) still works today, but Microsoft's own documentation marks it legacy, replaced by RBAC for Applications, with deprecation to be announced. Use RBAC for Applications where possible; Application Access Policies remain the fallback for tenants that have not yet migrated to RBAC for Applications.

SharePoint and OneDrive

Microsoft Graph's Selected permissions model replaces a tenant-wide permission with an explicit, per-resource grant: Sites.Selected for SharePoint, Files.SelectedOperations.Selected for individual files/folders. Verify with your Entra ID administrator that a narrowed permission still covers everything your Lasernet Core configuration needs before relying on it.

Discuss these options with your Entra ID/Microsoft 365 administrator before deploying application authentication, rather than granting the broadest available permission by default.