Service Principal Graph API Access Not Restricted to Single Mailbox

Goal: Use a service principal (Entra ID app registration) with Microsoft Graph API permissions to download CSV attachments from a single, specific email inbox — with access scoped to that one mailbox only, not tenant-wide.

Steps completed so far:

Registered/configured the app and assigned it Graph API application permissions (likely Mail.Read or Mail.ReadWrite, application type — not delegated).

Ran a PowerShell script intended to restrict the app's mailbox scope to a single account (using Exchange Online's Application Access Policy feature via New-ApplicationAccessPolicy).

New-ApplicationAccessPolicy `

-AppId “your-graph-client-id” `

-PolicyScopeGroupId “******@yourcompany.com” `

-AccessRight RestrictAccess `

-Description “Restrict graph-email-reader to service account only”

above script ran successfully.

but still when i run below script

Test-ApplicationAccessPolicy `

-AppId “your-graph-client-id” `

-Identity “******@yourcompany.com” is shows enabled

New-ApplicationAccessPolicy (Exchange PowerShell) Test-ApplicationAccessPolicy Limiting application permissions to specific Exchange mailboxes. i have followed all official documentations.

it still pings all emails even after policy is created for app to restrict for single email enabled security group