Connecting to exchange online using Microsoft Graph APIs through a Demon application

Question

I'm trying to connect to exchange online and do certain operations with the emails using Microsoft Graph API 1.0 and this is all done in a demon program. I'm using Client Credential workflow for authentication, below is the small piece of code

AuthenticationContext authenticationContext = new AuthenticationContext(string.Format(CultureInfo.InvariantCulture, azureEndPoint, tenant));
            ClientCredential clientCredential = new ClientCredential(clientId, clientSecret);
            AuthenticationResult authenticationResult = await authenticationContext.AcquireTokenAsync(resource, clientCredential);

But for this code to return the authentication token I have to get Application Permissions to the azure app id against microsoft graph api. The caveat here is if the permission is granted, the application id will have access to read emails of all users in the organisation and due to this reason tenant admin has strictly refused to grant the permission.

I tried my luck with consent framework but that requires user intervention to enter his/her id and password which is not possible in case of a demon program. I read few blogs like below but they all end up entering the user id password to get to the redirect url which defeats the whole demon thing https://blogs.msdn.microsoft.com/exchangedev/2015/01/21/building-daemon-or-service-apps-with-office-365-mail-calendar-and-contacts-apis-oauth2-client-credential-flow/

Is there any way I can give read/write access to azure application id for specific email ids in the tenant? Or alternatively any smart way to somehow get to the mailbox without user intervention?

Thanks in advance,

Vivek

juunas juunas · Accepted Answer · 2019-01-09T08:03:22

You can only use app permissions with client credential grant flow.

To access only specific users' emails, you'd have to do a different approach. This does require each user to consent individually.

Have the users login to your app, require consent for access to their email. Upon returning to your app, acquire a refresh token and store it securely. A refresh token is user-specific. Then in your daemon service you acquire an access token for each user using their refresh token. If the acquire fails because the refresh token has been invalidated, the user will need to be notified to login again.

Connecting to exchange online using Microsoft Graph APIs through a Demon application

2 Answers