Restricting access to Exchange API

Question

I need to be able to setup Appointments for all Exchange accounts within our domain and also cancel these Appointments. Email is hosted on Office 365.

I already figured out how to create Appointments (using CreateItems()). After Appointments are created I receive Appointments ID-s in return value (ID-s will be saved in the database). Using these ID-s I can later bind to them and delete them or cancel. Everything works on my own account.

Doing this for other accounts (using Exchange Impersonation) presents a security issue. We can dedicate a service account on domain just for this purpose but can it be limited to only be able to do these 2 things:

1. Create Appointments for other accounts using CreateItems.

2. Bind to existing Appointment (in another account) via ID and delete it

?

We don't want this service account to be able to do anything else (i.e. access email, Contacts, list Appointments, etc). Is this possible?

Answer 1

Depends on the version of Exchange your using in Office365 the best method to do this is with a Transport Rule see https://technet.microsoft.com/en-us/library/mt800696(v=exchg.150).aspx. The other option of for 0365 or Exchange 2016 is to use REST which allows you to create an application that will just have access to Calendars. For older versions of OnPrem Exchange Impersonation is really the only way to get the correct flow to operate.