Guys,

 I was hoping you could help me with the problem below.

The dev team is creating an in house application that requires accessing contact information from Exchange. Dev believes that in order to do this they need Exchange impersonation enabled for one of their accounts.

We obviously have some security concerns.

Do you have any recommendations on how the dev team could query for contact information securely?

thanks in a

To access a Folder in Exchange using EWS you just need access to the folder itself which can be granted via add-MailboxFolderPermissions. Eg create a Service Account and grant that service account access to that Contacts Folder you need to access. You can then track and audit the use of the Service Account.

The downside of this when you add new users you will need a process to grant these rights to Contact Folder in the new Mailboxes (using Impersonation this would just be automatic). The other problem maybe to do with throttling https://msdn.microsoft.com/en-us/library/office/jj945066(v=exchg.150).aspx if its a multi threaded application however you can just assign a different throttling policy to the service account in this case eg something like https://community.bittitan.com/kb/Pages/How%20do%20I%20disable%20the%20Exchange%20throttling%20policy%20for%20Exchange%202010%20and%202013.aspx

Cheers
Glen

• Edited by Glen ScalesMVP 4 hours 34 minutes ago

To access a Folder in Exchange using EWS you just need access to the folder itself which can be granted via add-MailboxFolderPermissions. Eg create a Service Account and grant that service account access to that Contacts Folder you need to access. You can then track and audit the use of the Service Account.

The downside of this when you add new users you will need a process to grant these rights to Contact Folder in the new Mailboxes (using Impersonation this would just be automatic). The other problem maybe to do with throttling https://msdn.microsoft.com/en-us/library/office/jj945066(v=exchg.150).aspx if its a multi threaded application however you can just assign a different throttling policy to the service account in this case eg something like https://community.bittitan.com/kb/Pages/How%20do%20I%20disable%20the%20Exchange%20throttling%20policy%20for%20Exchange%202010%20and%202013.aspx

Cheers
Glen

• Edited by Glen ScalesMVP Friday, July 17, 2015 2:54 AM