An application access policy is a Microsoft 365 control that limits which mailboxes an app can reach, even when the app has application permissions. In Exchange Online, it can scope access to a defined set of users or mail-enabled security groups, reducing the damage if an app registration, secret, or token is abused.
This matters because attackers who gain OAuth consent or steal an app token may try to read, send, or stage data across many mailboxes through Microsoft Graph. A broad permission set can turn a single compromise into tenant-wide mailbox access. Application access policies help defenders apply least privilege, contain abuse, and detect when an app is reaching mailboxes outside its intended role.