Microsoft Graph API - AuthenticationError when accessing mail

Question

I'm currently implementing an Outlook Add-In that should access certain mail fields. So I setup a starter project and set the delegated Mail.Read permission in the Microsoft Azure Active Directory settings and added it to my scope configuration. However, when I send the request for

graph.microsoft.com/v1.0/me/messages/

I get this as a response:

Error: Bad Request

at IncomingMessage.<anonymous> (C:\Users\zz\public\javascripts\odata-helper.js:53:29)
at IncomingMessage.emit (events.js:322:22)
at endReadableNT (_stream_readable.js:1187:12)
at processTicksAndRejections (internal/process/task_queues.js:84:21) {                                                
code: 400,
bodyCode: 'AuthenticationError',
bodyMessage: 'Error authenticating with resource'
}

I don't understand why this error appears since the user authentication works and I don't have any problems with other Graph Endpoints (e.g. retrieving a list of my OneDrive files from /me/drive/root/children)

I am using this as a codebase: https://docs.microsoft.com/en-us/office/dev/add-ins/develop/create-sso-office-add-ins-nodejs

Please provide a request or correlation id and timestamp. If not available in the exception then you can get them inspecting the response in fiddler. — Alfredo R
Hi did you have a chance to look into my answer? Is it helpful? — Allen Wu

Allen Wu Allen Wu · Accepted Answer · 2020-07-16T06:56:07

I didn't reproduce your issue and graph.microsoft.com/v1.0/me/messages works fine in the sample you shared.

Please refer to my configuration.

In addition to the configuration mentioned in the documentation, I also made the following changes.

Add a Mail.Read Delegated permission in Azure AD app.

Modify the Microsoft Graph endpoint in app.js file. Please note I'm querying the subject property of messages. So I modified the two places: $select=subject&$top=10 and itemNames.push(item['subject']).

app.get('/getuserdata', async function(req, res, next) {
  const graphToken = req.get('access_token');

  const graphData = await getGraphData(graphToken, "/me/messages", "?$select=subject&$top=10");

  if (graphData.code) {
      next(createError(graphData.code, "Microsoft Graph error " + JSON.stringify(graphData)));
  }
  else 
  {
    const itemNames = [];
    const oneDriveItems = graphData['value'];
    for (let item of oneDriveItems){
        itemNames.push(item['subject']);
    }
    res.send(itemNames)
  }
}

In the add-in manifest file "manifest\manifest_local.xml", I add a scope "Mail.Read".

<WebApplicationInfo>  
    <Id>a7eb1d00-f724-4799-8a46-809f2dba63f8</Id>
    <Resource>api://localhost:44355/a7eb1d00-f724-4799-8a46-809f2dba63f8</Resource>
    <Scopes>  
      <Scope>Files.Read.All</Scope>
      <Scope>profile</Scope>
      <Scope>Mail.Read</Scope>
    </Scopes>  
</WebApplicationInfo>

In the file routes\authRoute.js, I add the 'Mail.Read' like this:

  else {
    const [schema, jwt] = authorization.split(' ');
    const formParams = {
      client_id: process.env.CLIENT_ID,
      client_secret: process.env.CLIENT_SECRET,
      grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
      assertion: jwt,
      requested_token_use: 'on_behalf_of',
      scope: ['Files.Read.All', 'Mail.Read'].join(' ')
    };

These are all the configurations and I can get the subject of messages in Microsoft Word addin:

Microsoft Graph API - AuthenticationError when accessing mail

1 Answers