Graph API Integration issue insufficient priviledge for outlook mail in dotnet .Any support will be highly appreciated

vis bharti 0

I have created one console application .And on Azure i have created one app for organisation single tenant.Created Client Id and Secret .All permissions for mail i have given from both delegated and application tab. Since Requirement is to scan attachments from email and save in local folder.

Getting message

Code: Authorization_RequestDenied

Message: Insufficient privileges to complete the operation.

When checking token in jwt.io it is not showing all the scopes.

Scopes checked on azure active directory are the following

Those scopes are not visible when token i pasted on jwt.io

so denied access is showing. When scopes will be visible in token or is there any step that i have

missed?
Office365

vis bharti 0

I have provided all scope for mail and tried to give consent from graph explorer. But in token i am not able to find the scope that i have provided on azure active directory. Granted for Default Directory I am expecting to get the token from graph api sdk which can read the mail and save the attachments in my local folder and move the mail message to backup folder. Graph API permission

This is my code

using System;
using System.Collections.Generic;
using System.Linq;
using System.Net.Http;
using System.Threading.Tasks;
using Microsoft.Graph;
using Microsoft.Identity.Client;

namespace FeeServices.BatchEmailProcessor
{
    public class GraphAPIMailReaderLL
    {

        private string outlookMail = null;
        private string processedFolder = null;
        private string clientId = null;
        private string clientSecret = null;
        private string tenantId = null;
        
        public GraphAPIMailReaderLL(string clientId, string clientSecret, string tenantId, string mail) {
            InitializeGraphClient(clientId, clientSecret, tenantId, mail);            
        }

        public  void InitializeGraphClient(string _clientId,string _clientSecret,string _tenantId,string mail)
        {            
            outlookMail = mail;
            clientId = _clientId;
            clientSecret = _clientSecret;
            tenantId = _tenantId;
        }

        private async Task CreateOrCheckBackUpMailFolder(string mail, Microsoft.Graph.GraphServiceClient graphClient)
        {
                IUserMailFoldersCollectionPage allMailFolders = await graphClient.Users[mail].MailFolders.Request().GetAsync();
                //processedFolder = allMailFolders.Where(x => x.DisplayName == "ProcessedFolder").Select(x => x.Id).FirstOrDefault();
                //if (processedFolder == null)
                //{
                //    var requestBody = new MailFolder
                //    {
                //        DisplayName = "ProcessedFolder",
                //        IsHidden = false,
                //    };
                //    var result = await graphClient.Me.MailFolders.Request().AddResponseAsync(requestBody);
                //    allMailFolders = await graphClient.Users[mail].MailFolders.Request().GetAsync();
                //    processedFolder = allMailFolders.Where(x => x.DisplayName == "ProcessedFolder").Select(x => x.Id).FirstOrDefault();
                //}            
        }

        private async Task<IUserMessagesCollectionPage> GetMessages(string subject, Microsoft.Graph.GraphServiceClient graphClient)
        {
            return await graphClient.Users[outlookMail].Messages
            .Request().Filter($"Subject eq '{subject}'").Expand("attachments").GetAsync();
        }

        public async Task<List<string>> SaveAttachmentToFile(string subject, string fileExtension, string filepath)
        {
            List<string> filenames = new List<string>();


            var app = ConfidentialClientApplicationBuilder.Create(clientId)
                .WithTenantId(tenantId)
                .WithClientSecret(clientSecret)
                .Build();
            var scopes = new string[] { "https://graph.microsoft.com/.default"};
            var authResult = await app.AcquireTokenForClient(scopes).ExecuteAsync();
            var graphClient = new GraphServiceClient(new TokenCredentialAuthProvider(authResult.AccessToken));
            //string tkn = "eyJ0eXAiOiJKV1QiLCJub25jZSI6IjFGeDRrbmY4VnRyOGtDUXA0THRCR3MtZzJmVUZFT0lpbjkyUTc1M0tHMzAiLCJhbGciOiJSUzI1NiIsIng1dCI6Ii1LSTNROW5OUjdiUm9meG1lWm9YcWJIWkdldyIsImtpZCI6Ii1LSTNROW5OUjdiUm9meG1lWm9YcWJIWkdldyJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTAwMDAtYzAwMC0wMDAwMDAwMDAwMDAiLCJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC9iYTUwMjhlYS0yZjg4LTQyOTgtYmJhNS1jZWNmOTUzNDJhNzUvIiwiaWF0IjoxNjc5MDM1NzQzLCJuYmYiOjE2NzkwMzU3NDMsImV4cCI6MTY3OTA0MDI0MSwiYWNjdCI6MCwiYWNyIjoiMSIsImFpbyI6IkFWUUFxLzhUQUFBQWxkYWFlZFVUZE45VFh6OS8rRTFoa21WNFJ3cmNFaGNKd3Z3L3FlYlUzTXBxUXcxNFBSNTNFbE1VcmdmMm8zcUtJVmoyZzhQZnJPRkFGejFLN3BDWCtBU21oSDF1QmQ3aTVkdy9DWlhIOVBjPSIsImFtciI6WyJwd2QiLCJtZmEiXSwiYXBwX2Rpc3BsYXluYW1lIjoiR3JhcGggRXhwbG9yZXIiLCJhcHBpZCI6ImRlOGJjOGI1LWQ5ZjktNDhiMS1hOGFkLWI3NDhkYTcyNTA2NCIsImFwcGlkYWNyIjoiMCIsImZhbWlseV9uYW1lIjoiUmVwb3J0cyIsImdpdmVuX25hbWUiOiJMTCIsImlkdHlwIjoidXNlciIsImlwYWRkciI6IjEwMy4xNjQuMjQwLjgyIiwibmFtZSI6IkxMIFJlcG9ydHMiLCJvaWQiOiJiZTYyYTkxOS00ZWJjLTQ1YWMtYWVkZC0wNDQwYTk5MGM0ZjQiLCJwbGF0ZiI6IjMiLCJwdWlkIjoiMTAwMzIwMDI4NjFGMkNEQyIsInJoIjoiMC5BUWdBNmloUXVvZ3ZtRUs3cGM3UGxUUXFkUU1BQUFBQUFBQUF3QUFBQUFBQUFBQUlBQlUuIiwic2NwIjoib3BlbmlkIHByb2ZpbGUgVXNlci5SZWFkIGVtYWlsIiwic3ViIjoiTl8yYzNEVV9PaXB6MmQwN09HdTdISDdBakNBWHR5eUZTaXpNOTdldnN4cyIsInRlbmFudF9yZWdpb25fc2NvcGUiOiJOQSIsInRpZCI6ImJhNTAyOGVhLTJmODgtNDI5OC1iYmE1LWNlY2Y5NTM0MmE3NSIsInVuaXF1ZV9uYW1lIjoiTEwuUmVwb3J0c0BpbmZvdmlzaW9uLmNvbSIsInVwbiI6IkxMLlJlcG9ydHNAaW5mb3Zpc2lvbi5jb20iLCJ1dGkiOiJRbTVmWlpXN1BrRzBWSlMydmwwT0FBIiwidmVyIjoiMS4wIiwid2lkcyI6WyJiNzlmYmY0ZC0zZWY5LTQ2ODktODE0My03NmIxOTRlODU1MDkiXSwieG1zX3N0Ijp7InN1YiI6ImlXa1UwWmJiNTFTNjY5ZWZUUVF4UkNaaDFNWnFvVUhnY3NXcm43SDlxRzgifSwieG1zX3RjZHQiOjEzNjI2NzI5NDJ9.SvamyYzWBAJEcEmB68ickKHnmwtj2UgncXDWTGf8gVTg2erSW9PEpburllIKBWX6WbHdL8x25S-u2u7zRu8Fp4a9zXmLWoOLi3CxdrGaxeIWHUi40B-pnQbBS0U8-Go3mtCepkQgD-uZUFa8o4yOChVTlHsdrWBff_INsCjqJ47K5eJ7JI8rF6nwflkXs3ZVqt2JVvs024TNCnnMXgbeH-jc6ZUG000OGArd9N5FpcnFL3yMmg8GFVaU_DGD--LJU2-xMI541CLjXX3L_DKf7NEXUfgkW9aW848YZzPxOycp1SLA0iRzc21Lfl8U95HqNPngNEK4ZJ4bvbskvp6aNg";
            //var graphClient = new GraphServiceClient(new TokenCredentialAuthProvider(tkn));

            //var user = await graphClient.Users[outlookMail].Request().GetAsync();
            //IGraphServiceUsersCollectionPage users = await graphClient.Users[outlookMail].Request().GetAsync();
            //Console.WriteLine($"Found {user} users in the tenant");
            await CreateOrCheckBackUpMailFolder(outlookMail, graphClient);
            //IUserMessagesCollectionPage messages =await GetMessages(subject, graphClient);
            //dynamic request= null;
            //string filename = null;

            //foreach (Message message in messages)
            //{

            //    foreach (Attachment attachment in message.Attachments)
            //    {
            //        if (attachment.Name.ToLower().EndsWith(fileExtension.ToLower()) || attachment.Name.ToLower().EndsWith(".xlsx"))
            //        {
            //            filename = string.Format(filepath, DateTime.Now.ToString("yyMMdd-hhmmss"));
            //            request = graphClient.Me.Messages[message.Id].Attachments[attachment.Id].Request()
            //            .GetHttpRequestMessage();

            //            request.RequestUri = new Uri(request.RequestUri.OriginalString + "/$value");
            //            var response = await graphClient.HttpProvider.SendAsync(request);

            //            var body = await response.Content.ReadAsByteArrayAsync();
            //            System.IO.File.WriteAllBytes(filename, body);
            //            filenames.Add(filename);
            //        }
            //    }

            //    await Delete(message.Id, graphClient);
            //}
            return filenames;
        }

        private async Task Delete(string messageId, Microsoft.Graph.GraphServiceClient graphClient)
        {
            Message movedMsg = await graphClient.Users[outlookMail].Messages[messageId].Move(processedFolder).Request().PostAsync();
        }      

    }
    class TokenCredentialAuthProvider : IAuthenticationProvider
    {
        private readonly string _accessToken;

        public TokenCredentialAuthProvider(string accessToken)
        {
            _accessToken = accessToken;
        }

        public Task AuthenticateRequestAsync(HttpRequestMessage request)
        {
            request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", _accessToken);
            return Task.FromResult(0);
        }
    }
}

2 answers

Zehui Yao_MSFT 5,831 Reputation points

2023-03-17T02:07:35.01+00:00

Hi vis bharti I noticed that your Mail.Read permission is not granted, if you are using application permission, you need to grant permission in AD. Hope this helps. Best Wishes.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
vis bharti 0 Reputation points

2023-03-19T10:50:54.3533333+00:00

Still issue exists since Mail.Read with all scopes are checked for delegated permission.

Can you check once again the issue since i tried to explain clearly the above issue by editing and updating the above issue.

vis bharti 0 Reputation points

2023-03-19T10:55:24.58+00:00

I am facing the consent issue on azure directory how to set up the user consent.

Since i want to give the consent to user for app. Admin is the client so for a user i want

to configure such that after giving the scope permission consent will be provided to user.

Zehui Yao_MSFT 5,831 Reputation points

2023-03-21T07:21:12.3033333+00:00

Hi @vis bharti ,would you mind providing a screenshot of the result you decoded in JWT?

vis bharti 0 Reputation points

2023-04-05T10:09:04.5733333+00:00

I have created one console application .And on Azure i have created one app for organisation single tenant.Created Client Id and Secret .All permissions for mail i have given from both delegated and application tab. Since Requirement is to scan attachments from email and save in local folder. Getting message Code: Authorization_RequestDenied Message: Insufficient privileges to complete the operation. When checking token in jwt.io it is not showing all the scopes. Scopes checked on azure active directory are the following Those scopes are not visible when token i pasted on jwt.io so denied access is showing. When scopes will be visible in token or is there any step that i have missed?
Permission screen shot

Jwt Token payload

vis bharti 0 Reputation points

2023-04-06T08:44:59.66+00:00

Hi Zehui , I have attached the screenshot of jwt decode and permission . Still i am not able to see the scope permission that i have configured on azure active directory for app

vis bharti 0 Reputation points

2023-04-06T08:48:05.3+00:00

Let me know what i am missing
Sign in to comment
Pollibondu 75 Reputation points

2023-03-19T10:55:41.6966667+00:00

Your idea is best
Please sign in to rate this answer.

0 comments No comments
Sign in to comment