How do I limit which Microsoft 365 mailboxes timetoreply can access?

This guide is for Microsoft 365 admins. It covers two things:

1. Setting up an admin account that can bulk add mailboxes without being a Global Administrator.
2. Limiting timetoreply to only the mailboxes you choose.

To see which permissions timetoreply asks for, read our security and privacy document.

1. Set up the admin account

1. In the Microsoft 365 admin center, go to Users → Active users and add a new user. You can also use an existing user.
2. Sign in to the Microsoft Entra admin center and go to Roles & admins.
3. Open the Privileged Role Administrator role, click Add assignments and add the user.

Caution

Privileged Role Administrator can assign any Microsoft Entra role, including Global Administrator. Use a dedicated account for bulk adding. If your organisation has Privileged Identity Management, make the role assignment time-limited.

Use this account when you bulk add mailboxes.

2. Choose which mailboxes timetoreply can read

Put the mailboxes you want timetoreply to read in a mail-enabled security group.

1. In the Exchange admin center, go to Recipients → Groups and click Add a group.
2. Choose Mail-enabled security and create the group.
3. Add the mailboxes you want timetoreply to read as members of the group.

3. Restrict timetoreply to that group

Older Microsoft method

These steps use an application access policy. Microsoft has replaced these with RBAC for Applications and recommends it for new setups. See Role Based Access Control for Applications in Exchange Online. If you’d like help, email [email protected].

Create an application access policy in Exchange Online PowerShell. Replace [email protected] with your group’s email address:

New-ApplicationAccessPolicy -AppId ca7f3ddb-4052-4e29-a3e1-9bef37e1bf4f -PolicyScopeGroupId group@yourcompany.com -AccessRight RestrictAccess -Description "Restrict timetoreply to selected mailboxes"

ca7f3ddb-4052-4e29-a3e1-9bef37e1bf4f is timetoreply’s Microsoft application ID.

Only applies to bulk add

This policy restricts the application permissions that bulk add uses. Mailboxes connected one at a time use delegated permissions instead, so this policy doesn’t restrict them.

To check it works, test a mailbox. Replace [email protected] with a mailbox in, or outside, the group:

Test-ApplicationAccessPolicy -Identity name@yourcompany.com -AppId ca7f3ddb-4052-4e29-a3e1-9bef37e1bf4f

Wait before bulk adding

Microsoft says a new policy can take more than an hour to take effect, even when the test shows it working. Wait before you bulk add mailboxes, so timetoreply only sees the mailboxes in the group.

Need help or have feedback?

Email us at [email protected]. We’re happy to help.