Not able to send email

Shahid 6

Hi,

I am trying to send an email using graph api with client credentials flow. App registration and app permission already configured as per# https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow.

I am getting auth token but using that token when i tried sending email , it responds back with invalid user whereas that user exist.

{
"error": {
"code": "ErrorInvalidUser",
"message": "The requested user '<<userid>> is invalid.",
"innerError": {
"date": "2022-09-07T05:22:38",
"request-id": "a21a880b-efb5-47ae-81d8-6d6af5ece6bf",
"client-request-id": "a21a880b-efb5-47ae-81d8-6d6af5ece6bf"
}
}
}

Below are the permission given:

Mail.Send. (application)

User.Read. (Delegated)

User.Read.All (application)

if i tried same endpoint by taking token from graph explorer interface then it works.
Could you please help me to know what i am missing here?

Thanks ,
Shahid

Zehui Yao_MSFT 5,831 Reputation points

2022-09-08T05:55:04.407+00:00

Hi I'm currently doing research on it.
Shahid 6 Reputation points

2022-09-08T06:08:46.7+00:00

Thanks ZehuiYao, Please let me know if you need additional info for same.
Zehui Yao_MSFT 5,831 Reputation points

2022-09-08T07:06:30.737+00:00

Hi, @Shahid , would you mind providing the request URL you are using?
Shahid 6 Reputation points

2022-09-08T11:15:08.937+00:00

Hi @Zehui Yao_MSFT ,
URL : https://graph.microsoft.com/v1.0/users/$fromAddress/sendMail
$fromAddress is the email address of sender.
Shahid 6 Reputation points

2022-09-08T11:29:02.617+00:00

Hi @Zehui Yao_MSFT ,

Token URL :
https://login.microsoftonline.com/$tenantID/oauth2/v2.0/token
$tenantID is replaced with value which i found on app overview page under Directory (tenant) ID field.

SendEmailURL : https://graph.microsoft.com/v1.0/users/$fromAddress/sendMail

$fromAddress is replaced with sender email address , and also tried with id which there under users tab for respective user.

2 answers

Zehui Yao_MSFT 5,831 Reputation points

2022-09-08T06:45:18.953+00:00

Hi @Shahid , I tested locally and can run successfully. Since explorer, the default is to get tokens with OAuth 2.0 authorization code grant flow instead of client credentials flow,
so I'm not sure if you got the token correctly.
You can refer to this documentation to get a token. Hope this can help you. Best Regards.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Shahid 6 Reputation points

2022-09-08T11:22:26.37+00:00

Hi @Zehui Yao_MSFT , Thank you so much for you answer, I have tried similar way only except i provide admin consent from azure portal itself , as i want server to server communication without any user/admin intervention .

Where did you get that user id which is mentioned in url?

Zehui Yao_MSFT 5,831 Reputation points

2022-09-09T07:06:13.887+00:00

Hi, by requesting the URL: GET https://graph.microsoft.com/v1.0/users, you can require all the users in you tenant. In the response, The response contains id and userPrincipalName that can be used to request the /sendMail endpoint. Have you tried use other users on this issue?

Shahid 6 Reputation points

2022-09-09T07:19:31.01+00:00

Hi @Zehui Yao_MSFT ,
i used that id but its not working give response as below.

{"error":{"code":"OrganizationFromTenantGuidNotFound","message":"The tenant for tenant guid
'9a8a8fab-e24c-475b-a32e-3c3cc2d38627' does not
exist.","innerError":{"oAuthEventOperationId":"7eecad40-a2a0-4090-bf0c-e592aa503fff","oAuthEventcV":"Lr53x6ITBIClqfXCpPKo5Q.1.1.1","errorUrl":"https://aka.ms/autherrors#error-InvalidTenant","requestId":"745ccb05-8725-4311-9c6c-10d7aea2e8de","date":"2022-09-09T07:19:17"}}}

Zehui Yao_MSFT 5,831 Reputation points

2022-09-09T07:34:29.657+00:00

Hi, OrganizationFromTenantGuidNotFound comes mostly when there is no mailbox present.
You should have the Exchange Online License to work with /SendMail endpoint because this endpoint is on exchange workload.
Here is a solved issue you could refer: https://stackoverflow.com/questions/67432245/microsoft-graph-organizationfromtenantguidnotfound-when-using-mail-send

Shahid 6 Reputation points

2022-09-09T07:43:23.56+00:00

ok, I don't have license as i am doing POC with my personal account for my company project. I have AAD free subscription with that account. But i am wondering why does it work with token that is taken from Graph explorer?

Zehui Yao_MSFT 5,831 Reputation points

2022-09-09T08:07:57.437+00:00

May I ask Is it the same userid?

Shahid 6 Reputation points

2022-09-09T08:32:35.77+00:00

If i use graph explorer token , it does not work with that user id but with email address in url. For instance
: https://graph.microsoft.com/v1.0/users/d*****shahidhasan[@](/users/na/?userId=13b1dcfc-4001-0003-0000-000000000000).com/sendMail

Zehui Yao_MSFT 5,831 Reputation points

2022-09-19T08:47:26.313+00:00

Hello @Shahid , I spent some time working on the problem, per my test, I guess you're logged into your explorer with your personal account (d*****shahidhasan@Stuff .com).

This means that the explorer will authenticate with your personal account through the OAuth 2.0 authorization code grant flow.

However, your personal account can have two identities, tenant identity and personal identity.(the same account can have different identities when using different authentication flow, because you will be working in different domains, It is primarily used to distinguish between user information in the AD domain and other domains so sending mail using client credentials flow is required to have an exchange license )

So when you use client credentials flow authentication, your personal account will use the guest identity in the tenant in AD domain. The previous actions in the explorer cause your account to be person identity in gmail domain, the properties of the same account like id and userPrincipalName will be different.

client credentials flow in postman, property in tenant identity
https://graph.microsoft.com/v1.0/users

authorization code grant flow in explorer, property in personal identity
https://graph.microsoft.com/v1.0/users

Zehui Yao_MSFT 5,831 Reputation points

2022-09-19T08:47:38.923+00:00

So when you use explorer tokens, it means you have to use this account‘s personal identity, so it is feasible for you to use email addresses, and the user id must be the user id under your personal identity, not the user id ordered under your tenant identity. Hopefully, my statement will make you understand.

Shahid 6 Reputation points

2022-09-27T07:24:50.577+00:00

Thanks @Zehui Yao_MSFT

Zehui Yao_MSFT 5,831 Reputation points

2022-09-28T03:07:12.69+00:00

Hi @Shahid , do you need any other help, would you mind provide an update on the status of this issue?
Sign in to comment
sanjay mallik 1 Reputation point

2022-10-20T13:35:41.983+00:00

Hi @Zehui Yao_MSFT ,

I was also facing the same issues what you have discussed in the above conversation, I followed all your suggestion and now client credential flow is working for me. Thanks a lot for your suggestions.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment