How access IMAP Folder of a shared mailbox in Microsoft365 over OAUTH2 and Microsoft.Identity Class

Question

Hello,

I've a really angry problem to access an shared mailbox folder over OAUTH2 with Microsoft.Identity Classes.

Prerequisite:

Exchange Powershell:

• Create a new serviceprincipal with this app
• Add mailbox permissions to main user (her: @mailbox.de) and shared mailbox (@mailbox.de/support or ******@mailbox.de)

Workflow for main user (******@mailbox.de):

1. Get App Access Token with clientID, tenantID, secretvalue, scope := https://outlook.office365.com/.default

VB.NET

Dim confidentalApp As IConfidentialClientApplication = ConfidentialClientApplicationBuilder.Create(clientId).WithTenantId(tenantId).WithClientSecret(clientSecret).Build() Dim result As AuthenticationResult = Await confidentalApp.AcquireTokenForClient(scopes).ExecuteAsync() Dim accessToken As String = result.AccessToken

2. Generate User / Token Key with imap user and result token from 1)

Dim xOAuthKey = OAuth2.GetXOAuthKeyStatic(imapuser, accessToken)

3. Try access to folder INBOX of imapuser with 3th parity tool over OAUTH2

imap.Login(Nothing, xOAuthKey, AuthenticationMethods.SaslOAuth2, AuthenticationOptions.None, Nothing)

RESULT:

With the master mailbox (******@mailbox.de) it perfect runs. I can get he folder and all Mails in this folder.

[11:00:40.81] [INFO] Will resolve host "outlook.office365.com". [11:00:40.86] [INFO] Host "outlook.office365.com" resolved to IP address(es) 40.99.201.178, 40.99.201.210, 52.97.201.226, 40.99.217.50. [11:00:40.87] [INFO] Will connect to host "outlook.office365.com" on port 993. [11:00:43.90] [INFO] Socket connected to IP address 40.99.201.178 on port 993. [11:00:43.93] [INFO] Will start TLS/SSL negotiation sequence. [11:00:43.97] [INFO] TLS/SSL negotiation completed. [11:00:44.05] [RECV] * OK The Microsoft Exchange IMAP4 service is ready. [Token deleted...]\r\n [Total 160 bytes received.] [11:00:44.07] [INFO] Get the list of IMAP4 capabilities via CAPABILITY command. [11:00:44.08] [SEND] MBN00000001 CAPABILITY\r\n [11:00:44.09] [RECV] * CAPABILITY IMAP4 IMAP4rev1 AUTH=PLAIN AUTH=XOAUTH2 SASL-IR UIDPLUS ID UNSELECT CHILDREN IDLE NAMESPACE LITERAL+\r\n [Total 115 bytes received.] [11:00:44.10] [RECV] MBN00000001 OK CAPABILITY completed.\r\n [Total 38 bytes received.] [11:00:44.11] [INFO] Connected to mail service at host "outlook.office365.com" on port 993 and ready. [11:00:44.12] [INFO] Will login as "". [11:00:44.13] [INFO] Will try SASL XOAUTH2 authentication method. [11:00:44.14] [SEND] MBN00000002 AUTHENTICATE XOAUTH2\r\n [11:00:44.15] [RECV] + \r\n [Total 4 bytes received.] [11:00:44.16] [SEND] ********\r\n [11:00:44.99] [RECV] MBN00000002 OK AUTHENTICATE completed.\r\n [Total 40 bytes received.] [11:00:45.00] [INFO] Logged in as "". [11:00:47.76] [INFO] Select folder "Inbox". [11:00:47.77] [SEND] MBN00000003 SELECT "Inbox"\r\n [11:00:47.85] [RECV] * 0 EXISTS\r\n [Total 12 bytes received.] [11:00:47.85] [RECV] * 0 RECENT\r\n [Total 12 bytes received.] [11:00:47.86] [RECV] * FLAGS (\Seen \Answered \Flagged \Deleted \Draft $MDNSent)\r\n [Total 61 bytes received.] [11:00:47.87] [RECV] * OK [PERMANENTFLAGS (\Seen \Answered \Flagged \Deleted \Draft $MDNSent)] Permanent flags\r\n [Total 91 bytes received.] [11:00:47.87] [RECV] * OK [UIDVALIDITY 14] UIDVALIDITY value\r\n [Total 41 bytes received.] [11:00:47.88] [RECV] * OK [UIDNEXT 18609] The next unique identifier value\r\n [Total 55 bytes received.] [11:00:47.88] [RECV] MBN00000003 OK [READ-WRITE] SELECT completed.\r\n [Total 47 bytes received.] [11:00:47.89] [SEND] MBN00000004 LOGOUT\r\n [11:00:47.93] [RECV] * BYE Microsoft Exchange Server IMAP4 server signing off.\r\n [Total 59 bytes received.] [11:00:47.94] [RECV] MBN00000004 OK LOGOUT completed.\r\n [Total 34 bytes received.] [11:00:47.96] [INFO] Will disconnect from host "outlook.office365.com". [11:00:47.98] [INFO] Disconnected from host "outlook.office365.com".

With the shared mailbox (******@mailbox.de) I can't get access.

• Access with the shared mailbox email adress ******@mailbox.de

[11:03:25.38] [INFO] Assembly version: 12.3.0 build 647 for .NET 4.5. [11:03:25.38] [INFO] Will resolve host "outlook.office365.com". [11:03:25.43] [INFO] Host "outlook.office365.com" resolved to IP address(es) 52.97.232.210, 40.99.217.34, 52.97.201.242, 40.99.201.210. [11:03:25.43] [INFO] Will connect to host "outlook.office365.com" on port 993. [11:03:25.46] [INFO] Socket connected to IP address 52.97.232.210 on port 993. [11:03:25.47] [INFO] Will start TLS/SSL negotiation sequence. [11:03:25.52] [INFO] TLS/SSL negotiation completed. [11:03:25.59] [RECV] * OK The Microsoft Exchange IMAP4 service is ready. [Token deleted....]\r\n [Total 160 bytes received.] [11:03:25.61] [INFO] Get the list of IMAP4 capabilities via CAPABILITY command. [11:03:25.62] [SEND] MBN00000001 CAPABILITY\r\n [11:03:25.63] [RECV] * CAPABILITY IMAP4 IMAP4rev1 AUTH=PLAIN AUTH=XOAUTH2 SASL-IR UIDPLUS ID UNSELECT CHILDREN IDLE NAMESPACE LITERAL+\r\n [Total 115 bytes received.] [11:03:25.64] [RECV] MBN00000001 OK CAPABILITY completed.\r\n [Total 38 bytes received.] [11:03:25.65] [INFO] Connected to mail service at host "outlook.office365.com" on port 993 and ready. [11:03:25.66] [INFO] Will login as "". [11:03:25.67] [INFO] Will try SASL XOAUTH2 authentication method. [11:03:25.68] [SEND] MBN00000002 AUTHENTICATE XOAUTH2\r\n [11:03:25.69] [RECV] + \r\n [Total 4 bytes received.] [11:03:25.70] [SEND] ********\r\n [11:03:29.39] [RECV] MBN00000002 OK AUTHENTICATE completed.\r\n [Total 40 bytes received.] [11:03:29.41] [INFO] Logged in as "". [11:03:33.24] [INFO] Select folder "Inbox". [11:03:33.25] [SEND] MBN00000003 SELECT "Inbox"\r\n [10:18:30.20] [RECV] MBN00000003 BAD User is authenticated but not connected.\r\n [Total 58 bytes received.]

[10:18:30.21] [INFO] Error: The server has responded with negative reply. The server responded: MBN00000003 BAD User is authenticated but not connected.

Alternative I can access with main user Token but login with shared mailbox:

imap.Login("******@mailbox.de", xOAuthKey, AuthenticationMethods.SaslOAuth2, AuthenticationOptions.None, Nothing)

but this supported only the folders from the main user.

Has anybody an idea how to access this shared mailbox. Before IMAP access with plain authentification (name, password) we have access the mailbox with ******@mailbox.de\support - Folder INBOX

I don't use MS Graph or EWS!

Kind regards,

Markus Blume

Answer 1

First thing to check is whether IMAP is enabled on the Shared Mailbox generally it will be disabled by the security defaults (even if it was working in the past), Sometimes the Azure signin logs and Mailbox Audit logs [https://learn.microsoft.com/en-us/microsoft-365/compliance/audit-mailboxes?view=o365-worldwide can be helpful from a debug point of view to point to any other issues that might be occurring during the logon/connection process.

Answer 2

Hello,

yes, all IMAP checkboxes are enabled (in the master mailbox and the shared mailbox).

I've checked the access with the site

https://testconnectivity.microsoft.com/tests/O365Imap/input

with modern authentification (OAUTH) and alternative mailbox (optional). So I can access the shared mailbox and its folder. I've checked the access with EWS with the same APP data in Azure and got directly access to the shared mailbox ******@mailbox.de.

I don't think, that only I've the problem. Normally it is very simple:

Register APP in Azure with correct permissions

Set permissions (Service Principals) in Exchange to the mailboxes (normal and shared)

Then:

Create a Token with ClientID, TenantID, SecretValue of the APP

Genenerate a bearer token with Microsoft.Identity.Client (OAuth2.GetXOAuthKeyStatic)

Connect to Microsoft365 (scope: https://outlook.office365.com/.default) and login with the shared mailbox user and get folders and Mails

Is there another way an online site or a testtool to validate the token and the access?

Greetings,

Markus