Microsoft Graph to send mail with Client Credential Flow (application permission) and personal account

Question

I am learning Microsoft Graph and for this I use Graph Explorer and Postman.

With Graph Explorer : I am Signed In with my personal user account (hotmail). As soon as I am connected, I can see the token. Strangely when I copy/paste this token in jwt.io it cannot be decoded. Yet I can perform query like https://graph.microsoft.com/v1.0/me which returns me some infos of myself as a user (with http 200). Or this query https://graph.microsoft.com/v1.0/me/sendMail which allow me to send a test and receive a test mail (with http 202). All of these requests was "delegated permission". So I don't have any problem using Graph Explorer with my personnal account (hotmail).

With Postman : this time I will perform some tests with "application permission". I followed the steps below:

On the Azure Portal

Step 1: App registrations / New registration / I give a name / Choose the 3rd account type (Accounts in any organizational directory and personal Microsoft accounts) / Click on Register button

Step 2: Api permissions / Add permission / Microsoft Graph / Application permissions / Mail.Send (send mail as any user)

Step 3: Grand admin consent for... button to activate the permission

Step 4: Certificate & Secrets / New client secret / Enter a description / Click Add button

Step 5: Obtain a token in Postman

• POST

  • https://login.microsoftonline.com/{my-tenant-id-here}/oauth2/v2.0/token

• HEADERS

  • Content-Type: application/x-www-form-urlencoded

• BODY

  • client_id: {my-client-id-here}
  • client_secret: {my-client-secret-here}
  • grant_type: client_credentials
  • scope: https://graph.microsoft.com/.default

• OK I got a token

When copy/paste this token in jwt.io I see this:

Step 6: Query for listing all users

• GET

  • https://graph.microsoft.com/v1.0/users

• AUTHORIZATION

  • Bearer token: {bearer-token-received-previously}

• HEADERS

  • Content-Type: application/json

• OK I got infos for all users (as json)

Step 7: Query for sending a mail

• POST
  • https://graph.microsoft.com/v1.0/users/{user-principal-name}/sendMail
• AUTHORIZATION
  • Bearer token: {bearer-token-received-previously}
• HEADERS
  • Content-Type: application/json
• BODY (JSON)

{
  "message": {
    "subject": "This is my subject",
    "body": {
      "contentType": "Text",
      "content": "This is my content"
    },
    "toRecipients": [
      {
        "emailAddress": {
          "address": "[email protected]"
        }
      }
    ],
    "ccRecipients": [
    ]
  },
  "saveToSentItems": "false"
 }

• NOT OK Error: MailboxNotEnabledForRESTAPI - REST API is not yet supported for this mailbox

I would like to know why I got this error ? I can send email with Graph Explorer (when using delegated permission) and not with Postman (when using application permission).

As you can see below, I grant admin consent in Enterprise applications on the Azure Portal.

I read somewhere that the error means the user doesn't have the mailbox in EXO cloud. EXO is O365 Exchange Online Cloud. So if you don't have mailbox in the cloud O365 Exchange REST APIs will not work for these users. If that is the case, what would you do ?

I have a Web application which should send mails from a shared mailbox. No matter which user is connected, this is always the same mailbox which is used to send mails. That's why I go with "application permission" and "Client credential flow".

As explained above, I use my personal account (hotmail) for testing purpose but in production I'll use a work account (not accessible from my dev environment).

As a side note, I know there are libraries to facilitate the process and avoid using REST API calls (urls) but I don't think that can explain the problem I am facing.

Answer 1

"MailboxNotEnabledForRESTAPI - REST API is not yet supported for this mailbox" This error message means that the email account you are using to send email doesn't have an Exchange Online license.

For a personal account, you should use Delegated permission, which you have tried in Microsoft Graph Explorer. See Permissions here.

.

If we add the personal account to your tenant as a guest user, although we can Assign a license to a guest user (I assume we can assign EXO license to the guest user), the mailbox hosted in EXO is different from the mailbox of the personal account. They are totally 2 separated mailboxes. And in fact I failed to assign EXO license to the guest.

So in this case Client Credential Flow applies to the AAD users, not the personal account.

UPDATE:

For personal account which uses Delegated permission (you have tried in Microsoft Graph Explorer), the authority endpoint is https://login.microsoftonline.com/commonm/oauth2/v2.0/authorize or https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize.

But when you use client credential flow with Application permission, you have to specify the tenant id in the request https://login.microsoftonline.com/{tenant id}/oauth2/v2.0/authorize.

Although your personal account is added into the tenant as a guest user, it doesn't have EXO license (based on test we are unable to assign EXO license to it), so it won't be hosted in O365.

That is why we can't use client credential flow with personal account.