--- title: "Restricting Revenue Intelligence EWS Service to a Security Group Using PowerShell" slug: "restricting-ebsta-ews-service-to-a-security-group-using-powershell" description: "Restricting Revenue Intelligence EWS Service to a Security Group Using PowerShell. Fullcast Revenue Intelligence — fka Ebsta Knowledge Base." tags: ["Ebsta Knowledge Base", "Ebsta", "Revenue Intelligence", "Knowledge Base"] updated: 2026-02-05T17:05:25Z published: 2026-02-06T21:51:54Z canonical: "support.fullcast.com/restricting-ebsta-ews-service-to-a-security-group-using-powershell" stale: true --- > ## Documentation Index > Fetch the complete documentation index at: https://support.fullcast.com/llms.txt > Use this file to discover all available pages before exploring further. # Restricting Revenue Intelligence EWS Service to a Security Group Using PowerShell This guide shows you how to restrict the access of the "Ebsta EWS Service" to a certain group of users. This is useful if you only want Ebsta to have access to certain mailboxes. *You will need PowerShell access to your tenant to do this.* --- ## Step 1: Connect to Exchange Online ``` PowerShell     Connect-ExchangeOnline -Organization mydomain.onmicrosoft.com     ``` ## Step 2: Create a Mail-Enabled Security Group Create the Group: ``` PowerShell     New-DistributionGroup -Name "ebsta-EWS-SA-users" -Alias "ebstaEWSUsers" -Type Security     ``` Enable Mail for the Group: ``` PowerShell     Set-DistributionGroup -Identity "ebsta-EWS-SA-users" -EmailAddresses SMTP:ebstaEWSUsers@mydomain.com     ``` Verify the Group Creation: ``` PowerShell     Get-DistributionGroup -Identity "ebsta-EWS-SA-users"     ``` Now add the users to the group in Exchange Admin. ## Step 3: Grant Application Access Policy Find the App ID of your "Ebsta EWS Service Account": ``` PowerShell     Get-ServicePrincipal -DisplayName "Ebsta EWS Service"     ``` Create the Application Access Policy: ``` PowerShell     New-ApplicationAccessPolicy -AppId ""   \-PolicyScopeGroupId "ebsta-EWS-SA-users"   \-Description "Restrict Ebsta EWS app to only users in ebsta-EWS-SA-users group"   \-AccessRight RestrictAccess ``` ## Step 4: Verify the Policy ``` PowerShell     Get-ApplicationAccessPolicy -AppId ""     ``` ## Step 5: Test the Policy ``` PowerShell     Test-ApplicationAccessPolicy -Identity "user@mydomain.com" -AppId ""     ``` The output should confirm if the user is allowed or denied access based on their group membership.