microsoft graph client credentials - get oauth error sending email on behalf of user

Question

I successfully set up OAuth 2.0 client credentials for Microsoft Graph, I am getting the auth token no problem, subscribed to receive email webhooks for several users, and getting those email notifications.

In Azure Portal, I set up the application to have Microsoft Graph app level permissions for "Send mail as any user".

I am trying to forward an email using Graph, but I get a BadRequest error:

{
  "error": {
    "code": "BadRequest",
    "message":
      "Current authenticated context is not valid for this request. This occurs when a request is made to an endpoint that requires user sign-in. For example, /me requires a signed-in user.  Acquire a token on behalf of a user to make requests to these endpoints.  Use the OAuth 2.0 authorization code flow for mobile and native apps and the OAuth 2.0 implicit flow for single-page web apps.",
    "innerError": {
      "request-id": "a64c4533-9389-4284-8cf5-68fcadf21832",
      "date": "2018-05-27T17:34:29"
    }
  }
}

This is how I'm sending the request:

postData(
    `${graphVersion}/me/messages/${req.body.emailUid}/forward`,
    global.accessToken,
    JSON.stringify(forwardConfiguration),
    (requestError, data) => {
        if (requestError) {
            logger.log('error', "Failed to forward email: " + JSON.stringify(requestError));
        } else {
            logger.log("info", "Successfully forwarded email from " + req.body.email);
        }
    }
);

Marc LaFleur Marc LaFleur · Accepted Answer · 2018-05-27T18:07:37

You cannot use /me with Client Credentials.

This is because /me is simply an alias for /user/{currentUser}. When you use Client Credentials, there isn't a "user" for the API to map this alias too.

You need to explicitly specify the user you want:

/users/{userId or userPrincipalName}/messages

microsoft graph client credentials - get oauth error sending email on behalf of user

1 Answers