OAuth authentication with EWS Managed API applications for a specific mailbox

Question

We changed our application such that it authenticates an EWS application by using OAuth. The article «Authenticate an EWS application by using OAuth» was of great help.

The subsection «Configure for app-only authentication» describes how to give permissions by replacing the requiredResourceAccess property in the manifest with an example JSON:

{
    "resourceAppId": "00000002-0000-0ff1-ce00-000000000000",
    "resourceAccess": [
        {
            "id": "dc890d15-9560-4a4c-9b7f-a736ec74ec40",
            "type": "Role"
        }
    ]
}

However, this gives full_access_as_app to all mailboxes in the company. And we would like to limit the app's access to a specific mailbox. How can we adjust this example JSON?

Any help would be much appreciated.