Microsoft Graph API - messages of shared mailbox - 403 ErrorAccessDenied

JO-5324 81 Reputation points
2022-11-18T08:26:26.173+00:00

Summary:
I have created a public application which mainly fetches outlook emails from my users Outlook mailbox.
There are also other features available like: sending emails, creating draft emails etc. which are not relevant for this issue.

The application has so far fetched all emails successfully.
Now a user has a feature request, namely fetching emails from shared mailboxes.

Setup:
The following scopes are requested:
'offline_access', 'MailboxSettings.Read', 'Mail.ReadWrite.Shared', 'Mail.Send.Shared', 'User.Read'

Endpoint so far - which works fine:
'https://graph.microsoft.com/v1.0/me/messages?$top=100&$select=sentDateTime,from,toRecipients,subject,hasAttachments,id,isRead,flag,ccRecipients,bccRecipients,categories,body,conversationId,receivedDateTime,bodyPreview,isDraft,webLink,parentFolderId'

Additional endpoint - which results in an error:
'https://graph.microsoft.com/v1.0/users/' + sharedEmail + '/messages?$top=100&$select=sentDateTime,from,toRecipients,subject,hasAttachments,id,isRead,flag,ccRecipients,bccRecipients,categories,body,conversationId,receivedDateTime,bodyPreview,isDraft,webLink,parentFolderId'

Error:
This is the complete error message returned by the API:
StatusCodeError: 403 - {"error":{"code":"ErrorAccessDenied","message":"Access is denied. Check credentials and try again., Cannot find row based on condition."}}

Attempts to find the cause of the error:

  1. The user's IT department confirmed that the shared mailbox is hosted on Exchange Online
  2. The authentication and the user used for fetching the messages is still the user himself, he is still able to fetch his own messages

I would be grateful for any support!
Cheers!

Microsoft Security | Microsoft Graph
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Vasil Michev 119.5K Reputation points MVP Volunteer Moderator
    2022-11-18T08:55:13.687+00:00

    Does he have the relevant permissions to access the shared mailbox? Mail.ReadWrite.Shared will only work when he has been granted Full Access on the mailbox in question. The code itself is fine.

    1 person found this answer helpful.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.