---
title: Why does Activate need full_access_as_app?
slug: why-does-activate-need-fullaccessasapp
createdAt: 2025-08-17T22:34:31.873Z
---

Activate requires full\_access\_as\_app to read a mailbox, e.g. when doing email approvals.

The reasons are:

- Basic auth is no longer allowed on EWS so can't login as the email approvals inbox.
- Activate code impersonates the user in Office365 so full\_access\_as\_app is required, delegated rights can't be currently granted to allow only rights to a specific mailbox.
- Obtaining an OAuth token as the email approvals mailbox will require MFA which isn't possible in an unattended background process.



However, Application Access Policies can be applied to limit the subset of mailboxes that the Activate application registration can access.  Here's an example of how to do this.

```powershell
New-ApplicationAccessPolicy -AppId <your-app-id> `
   -PolicyScopeGroupId "Allowed-Mailboxes-Group" `
   -AccessRight RestrictAccess `
   -Description "Limit app to only these mailboxes"
p
```