Limiting application permissions to specific Exchange Online mailboxes (in our case the calendar of rooms)
A method for restricting access to specific mailboxes and calendars has been the use of Application Access Policies. However, as Role-Based Access Control (RBAC) for Applications is set to replace these policies, we want to emphasize the transition towards this new approach. Microsoft has indicated that Application Access Policies and RBAC for Applications can coexist for the time being; nevertheless, the long-term plan is to deprecate Application Access Policies. Therefore, we recommend adopting RBAC for Applications moving forward. We will ensure that our knowledge base article "Set up Microsoft Graph calendar integration" reflects this update.
RBAC for Applications:
https://learn.microsoft.com/en-us/exchange/permissions-exo/application-rbac