2

I'm trying to hit https://graph.microsoft.com/v1.0/users/{userId}/mailboxSettings endpoint with an auth token and in return receiving a 403 Error Access Denied response.

I have granted both application level and delegated permissions for MailboxSettings.Read, MailboxSettings.ReadWrite. I can verify that these permissions are enabled on the installed application via examination of my decoded auth token with the jwt.ms. Here is the exert from the decoded token:

"scp": "Directory.AccessAsUser.All Files.ReadWrite.All Group.ReadWrite.All Mail.Read Mail.ReadWrite Mail.Send MailboxSettings.Read MailboxSettings.ReadWrite Sites.ReadWrite.All"

I have also verified that the user I am requesting mailboxSettings for has been granted access via Admin Consent.

I am able to return mailboxSettings if I hit the endpoint for either the admin userId or the https://graph.microsoft.com/v1.0/users/me/mailboxSettings endpoint. Any help would be much appreciated.

Darrel Miller
  • 139,164
  • 32
  • 194
  • 243
ctownley
  • 21
  • 2

4 Answers4

1

Quickly I tested with Microsoft Graph Explorer and it works for me. So i would request you to test the above API call with Graph Explorer and see if you can repro the issue or not.

Dev
  • 2,428
  • 2
  • 14
  • 15
  • No luck for me in Graph Explorer either. – ctownley Feb 20 '19 at 17:22
  • Would you mind clarifying on the following? - if you were using an Application level or delegated permission - if your auth flow uses the v1 or v2 Azure AD endpoints - and would you mind posting the request URL you hit in Graph Explorer to get a successful response – ctownley Feb 20 '19 at 20:59
0

I believe the problem is that your token was generated using Delegated scopes. The Delegated flavor of MailboxSettings.Read and MailboxSettings.ReadWrite may only access the currently authenticated user’s mailbox.

In order to access other users, you need to use Application scopes. You can read more about how these scopes work (and how to select them) in this blog post: Application vs Delegated Scopes.

Marc LaFleur
  • 31,987
  • 4
  • 37
  • 63
0

As others have stated, delegated token only works for reading the mailboxSettings of the currently authenticated user. I had enabled mailboxSettings as an Application scope, yet I was getting the same error. The culprit of the issue was that I was using the Auth code grant for the token.

After switching to Client Credentials grant, I am successfully retrieving an Auth token that contains the mailboxSettings Application level scope, and am able to get 200 responses on endpoints for all users.

ctownley
  • 21
  • 2
0

I had the same problem using app-level authentication. I added all the same privileges and it still didn't work. I then requested a new token and it all sprang into life.

I know its an old question but I think the answer to the OP is - after changing the API permissions in Entra you need to get a new token for it to take effect.

Oly Dungey
  • 1,603
  • 19
  • 20