Restrict SMTPKeep to specific mailboxes

The Mail.Send application permission lets an app send as any mailbox in the tenant. SMTPKeep only sends as the mailbox each device is configured with, and you can enforce that inside Microsoft 365 with an application access policy.

Install-Module ExchangeOnlineManagement -Scope CurrentUser
Connect-ExchangeOnline
New-DistributionGroup -Name "SMTPKeep senders" -Type Security -Members scanner@yourdomain.com
New-ApplicationAccessPolicy -AppId <SMTPKeep app ID from your dashboard> -PolicyScopeGroupId "SMTPKeep senders" -AccessRight RestrictAccess -Description "SMTPKeep may send only as members of this group"
Test-ApplicationAccessPolicy -AppId <app ID> -Identity scanner@yourdomain.com

The dashboard's tenant page shows this script with your app ID and current device mailboxes filled in. When you add a device with a new mailbox, add that mailbox to the group:

Add-DistributionGroupMember -Identity "SMTPKeep senders" -Member frontdesk@yourdomain.com

Policy changes can take 30 minutes or more to apply in Exchange Online.