what grant type/flow to use for a daemon app registration with Mail.ReadWrite delegated permission to get to inbox

Question

I need to access to one particular daemon email box that the AD granted delegated permission to Mail.ReadWrite.
What flow I need to use because the token created by client_credentials flow seems not working with delegated access permission?
Also this authentication is not for a real online user to enter user and pass. it is going to be accessed programatically to read from an exchange server inbox folder.
what grant type/flow to use for a daemon app registration with Mail.ReadWrite delegated permission to get to inbox
Thanks
Sheida

Answer 1

Hi @sheida sadrai ,

Thanks for reaching out.

I understand you are trying to grant delegated permission to access one particular email box using daemon applications.

For daemon application, where you don't want user to explicitly sign-in, you can use client credentials grant flow but there is no option to use delegated permission with daemon applications.

However, there is an option to use application permission to specific mailbox, which limit application permission to specific Exchange Online Mailboxes by using by using the New-ApplicationAccessPolicy.

Application access policy restricts mailbox access for apps that have been granted any of the Microsoft Graph or Exchange Web Services permission scopes that the policy supports.

Reference : https://learn.microsoft.com/en-us/graph/auth-limit-mailbox-access

Hope this will help.

Thanks,
Shweta

----------------------------------------------

Please remember to "Accept Answer" if answer helped you.