This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(278.4, 39%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESJ%3C/text%3E%3C/svg%3E)
I am attempting to retrieve data from Message Trace API(ReportingWebService) by utilizing, other than built-in : Security Reader and Global Reader roles. Can someone help me, in knowing any other built in role for fetching the data? Or it would be great if you can help in listing down the exact Permissions needed which are related to ReportingWebService API, so that atleast I can try out creating a custom role based on these.
If you are using delegate permissions, you will need to have one of the "Reader" roles assigned. Alternatively, you can use application permissions (ReportingWebService.Read.All), details for example here: https://www.michev.info/blog/post/4067/modern-authentication-oauth-support-for-the-reporting-web-service-in-office-365
Hi @Vasil Michev , Thanks for your quick response!
I have already assigned Delegated and Application permissions based on Office 365 Exchange Online API i.e., ReportingWebService.Read and ReportingWebService.Read.All to my registered Application. But, seems like it requires at least a Role associated with your application.
I have tried assigning roles such as 'Reports Reader', but it does gives me error:
{
"ErrorCode": "",
"Message": "No permission to access the report for the organization ."
}
Is it compulsory for the Application to have, Security Reader, Global Reader or E****xchange Admin role?
Also, can you help me in listing some permissions out of which we can create a custom role, which will contain only the specific permissions for accessing the Message Trace API.
I stand corrected - you need the Global reader or Security reader role assigned to the service principal object even in application permission scenarios.
There are no custom permissions you can leverage for this endpoint. If you are only interested in message trace data, an alternative would be to use ExO PowerShell and the Get-MessageTrace cmdlet, which you can grant very granular permissions for. Another option might be to use the new /analyzedEmail endpoint, depending on the level of detail you need: https://learn.microsoft.com/en-us/graph/api/security-collaborationroot-list-analyzedemails?view=graph-rest-beta