O365 EWS w/ Impersonation UploadItems worked March 2024 - now 'access denied' error. All other features work.

James B Wood 0 Reputation points
2024-04-17T16:51:53.5966667+00:00

I spent quite a few weeks earlier this year writing a PowerShell utility to copy mail between users in a O365 Tenant (including the ability to place copied mail in a unique 'root' folder tree). After much trial and error I had a working script that did what I needed. I use a mix of EWS and EWS managed API calls, I've resolved token (refresh), service, impersonation and Application API access issues. Last used successfully 3/19/24.

The following week or 10 days later I revisited the code and found that all the features were still functioning - except UploadItems. The response from that is now: Access is denied. Check credentials and try again., The process failed to get the correct properties.

I tested my code against 4 of the Tenants I manage and found the same error for all of them. They had all worked previously. I've tested my Impersonation 'credentials' (tenantID, clientID, clientsecret) using EWSEditor - no issues. I've spent the last 3 weeks going over everything - script and tenants - I'm not getting anywhere. It feels like Microsoft changed something and didn't tell anyone.

Code snippets available upon request. I didn't post the code because I'm not get any code failures - I just can't UploadItems to the target mailbox.

Your help greatly appreciated. But I would also appreciate if you wouldn't reply with how-to links - this WAS working, I just need to know what changed and how to code for it.

Regards,

jbw

Microsoft Exchange Online Management
Microsoft Exchange Online Management
Microsoft Exchange Online: A Microsoft email and calendaring hosted service.Management: The act or process of organizing, handling, directing or controlling something.
4,185 questions
Exchange Server Development
Exchange Server Development
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Development: The process of researching, productizing, and refining new or existing technologies.
509 questions
PowerShell
PowerShell
A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
2,067 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vasil Michev 95,581 Reputation points MVP
    2024-04-18T07:25:12.5466667+00:00

    Are you using the role? Microsoft is in the process of deprecating this: https://techcommunity.microsoft.com/t5/exchange-team-blog/retirement-of-rbac-application-impersonation-in-exchange-online/bc-p/4063002#M37971

    Though as mentioned in the article, this should only happen starting from May, and should not affect existing assignments. Best open a support case to verify, or comment on the article above where the PM is fairly active.

  2. James B Wood 0 Reputation points
    2024-04-18T13:38:26.42+00:00

    Vasil -

    This is a registered App. I'm already using "full_access_as_app" permissions and a Bearer token to authenticate the mailbox service. I can create folders in the destination mailbox, find and read source and destination items, but the response on UploadItems is always 'access denied'. This was working 4-5 weeks ago. I've read the article referenced previously, but I'm not using a user account for authentication (and I tried assigning ApplicationImpersonation role to the app - but it didn't fix anything).

    Regards,

    jbw

    0 comments