Microsoft 365: let an app send mail from chosen mailboxes only
Granted the usual way in Entra ID, Mail.Send lets an application send as any mailbox in your organisation, the CEO's included. Our step-by-step guide registers the app, puts the allowed mailboxes in one group, and scopes the app with Exchange RBAC for Applications, with copy-and-paste PowerShell, tests that prove it both ways, and the legacy Application Access Policy for existing tenants.