3797601 - Additional Delegate Permissions To Microsoft Graph Appearing "Read And Write User And Shared Mail" And "Read And Write User And Shared Calendars"

When the users attempted to reconnect to Server Side Integration, the SAP Cloud for Customer application requested two additional delegated permissions:

Mail.ReadWrite.Shared (Read and write user and shared mail)
Calendars.ReadWrite.Shared (Read and write user and shared calendars) 

SAP Cloud for Customer

1. Log into the system.
2. Go to E-mail Integration work center.
3. Open User Settings work center view.
4. Select the Microsoft Graph option on the mailbox list.
5. Approval requirements pop up screen open.
6. There are two new permissions (Read and write user and shared mail and Read and write user and shared calendars)

The additional permissions requested after the 2608 upgrade are expected and were added intentionally:

Mail.ReadWrite.Shared (Read and write user and shared mail)
Calendars.ReadWrite.Shared (Read and write user and shared calendars)

These permissions were added to support scenarios involving shared/delegated mailboxes and shared calendars, and to ensure that the permissions requested during authorization match the permissions required by synchronization.

From a security perspective, it is important to clarify that these delegated permissions do not provide tenant-wide access to other users' mailboxes.
They allow the application to work with shared mailbox or calendar content only where the signed-in user already has the corresponding Exchange permissions. The user's existing Exchange access, therefore, remains the boundary.

System expected behavior.

1. Can C4C be configured to not to require these permissions?

Yes. The shared mailbox/calendar permissions can be removed from the configuration if this functionality is not required. However, this has functional implications: removing the relevant shared permissions means that the add-in will no longer be able to work with the corresponding shared mailboxes or shared calendars.

2. Can access be limited to specific shared mailboxes?

The delegated Mail.ReadWrite.Shared permission itself cannot be configured for a specific list of shared mailboxes. However, granting this permission does not give the application access to all shared mailboxes in the organization.
It only allows access to mailboxes that the signed-in user already has permission to access in Exchange.

C4C; SSI; Server Side; Permission; Authorization; Shared; Calendars; Shared; Mail , KBA , LOD-CRM-GW-SCC , Invisible CRM - Smart Cloud Connect Solution , How To

SAP Cloud for Customer add-ins all versions ; SAP Cloud for Customer core applications 2608