0

I want to read mails of users of a specific domain (tenant) using Outlook API. However, I don't have privileges to register new app in Azure portal, for that domain, and so am not able to use Graph API. We cannot use Outlook API without an OAuth app. In this case, using IMAP/POP3 is my only choice? How secure is to use IMAP/POP3 to read mails when compared to Azure AD Graph API? Please advise.

MAK
  • 1,915
  • 4
  • 20
  • 44

1 Answers1

2

It depends on what you really want to achieve.

If you just want to read the messages, configuring your mailbox in Outlook or other email provider with IMAP/POP3 is a preference. You don't need to worry about its security, it has been in service for decades.

For Microsoft Graph API, to call Microsoft Graph, your app must acquire an access token from the Microsoft identity platform. See Authentication and authorization basics for Microsoft Graph to learn more details about it.

So the point is how you want to read your email.

If you are developing your own app, using Microsoft Graph API is certainly the best choice. You can test GET https://graph.microsoft.com/v1.0/me/messages to list your emails in Microsoft Graph Explorer without registering an app in Azure AD.

Allen Wu
  • 15,529
  • 1
  • 9
  • 20
  • Thank you. I thought it is not possible to get access token without registering an app as all the following flows need a Client ID: Client Credentials Flow, Resource Owner Password Flow, Implicit Flow, Authorization Code Flow. Please advise if I am wrong. Could you let me know how to access mails without registering an app please? – MAK Dec 10 '19 at 05:37
  • @MAK No. It's impossible. The Authentication is designed for security. If it doesn't require an access token, anyone can access your emails. In this case, just open your mailbox to access your email. – Allen Wu Dec 10 '19 at 05:43
  • I got it. Using the Graph explorer link you sent, I can ONLY TEST the /me/messages API endpoint. However, if I want to use it in my own app, to read mails, I should register the app, get token and hit API. – MAK Dec 10 '19 at 05:53