"ErrorAccessDenied Message: Access is denied. Check credentials and try again." When I try to create a draft email for another user

Question

I'm playing around with the API in Make.com to connect it to other apps and some AI APIs but I'm getting a access error when I attempt to create a draft email for another user. I checked the app permissions and they were delegated at first so I create application permissions but still no luck.

Here is the response and request:

{

"_engineData": {

    "calledAt": "Not available"

},

"response": {

    "status": 403,

    "headers": {

        "cache-control": "private",

        "transfer-encoding": "chunked",

        "content-type": "application/json; odata.metadata=minimal; odata.streaming=true; IEEE754Compatible=false; charset=utf-8",

        "strict-transport-security": "max-age=31536000",

        "request-id": "36ecf95e-b203-46d1-baf6-c1b8c1d0f260",

        "client-request-id": "36ecf95e-b203-46d1-baf6-c1b8c1d0f260",

        "x-ms-ags-diagnostic": "{\"ServerInfo\":{\"DataCenter\":\"East US 2\",\"Slice\":\"E\",\"Ring\":\"5\",\"ScaleUnit\":\"004\",\"RoleInstance\":\"BN1PEPF0000610C\"}}",

        "date": "Mon, 08 Jul 2024 22:41:38 GMT",

        "connection": "close"

    },

    "body": {

        "error": {

            "code": "ErrorAccessDenied",

            "message": "Access is denied. Check credentials and try again."

        }

    },

    "_engineData": {

        "calledAt": "Not available"

    }

},

"request": {

    "url": "https://graph.microsoft.com/v1.0/users/a09effca-e2bc-4e1c-99df-a7072ba5995f/messages",

    "qs": {},

    "headers": {

        "user-agent": "Make/production",

        "content-type": "application/json",

        "authorization": "***"

    },

    "method": "POST",

    "body": {

        "subject": "Did you see last night's game?",

        "importance": "Low",

        "body": {

            "contentType": "HTML",

            "content": "They were <b>awesome</b>!"

        },

        "toRecipients": [

            {

                "emailAddress": {

                    "address": "AdeleV@contoso.com"

                }

            }

        ]

    }

}

}

Here is my permissions page in Entra:

Answer 1

Hi @Dominique Karolczak

After testing, application permissions are required to create drafts for other users, so you need to get the token through the client credential flow.

After obtaining the token, please parse it in jwt.ms and ensure that the token has the application permission Mail.ReadWrite. The parsing result is shown below:

See this link for client credential flow details:

https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-client-creds-grant-flow

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.