What license do I need to be able to send emails through Microsoft Graph via an unattended desktop app?

Question

What license do I need to be able to send emails through Microsoft Graph via an unattended desktop app?

WesWilliams-4769 65

Context: I'm a developer who writes console programs that scrape web sites. When an event occurs, I send an email to myself. MS recently turned off basic authentication. No sample program anywhere on the internet works to send via Microsoft Graph or other (no Twilio Sendmail or 3rd party service please. MS blocks them).

Question: What Azure service or license do I need to be able to send emails from an unattended Windows Desktop program to myself?

This web site says I need a license" https://zimmergren.net/sending-e-mails-using-microsoft-graph-using-dotnet/

I have a MS Office 365 Subscription

I have an entra application with client secrets and API Permissions for Mail.Read and Mail.Send

I have no problem authenticating. It's when I do "mail.send" when it says "Unauthorized"

Tried and Failed:

I've set up a MS Entra Client Secret.
I've tried sending with PublicClientApplicationBuilder and got this on

  var request = new HttpRequestMessage(HttpMethod.Post, "https://graph.microsoft.com/v1.0/me/sendMail")
  
  { Content = requestContent };
  request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token);
  
  var response = await httpClient.SendAsync(request);`

Unauthorized

{"error":{"code":"OrganizationFromTenantGuidNotFound","message":"The tenant for tenant guid '00000000-f40e-4889-977c-67abc6b1ea17' does not exist.","innerError":{"oAuthEventOperationId":"ade9420d-f3ba-4a2f-bdf9-cc02f213455d","oAuthEventcV":"3Z1lS49nvGfZCpcrkoKZnQ.1.1","errorUrl":"https://aka.ms/autherrors#error-InvalidTenant","requestId":"670f3d80-8c63-4353-9135-4ff203e7e78f","date":"2025-01-10T21:14:42"}}}

Yes, the tenant ID is correctly set

WesWilliams-4769 65

Here is the code. Guid's are obfuscated. I marked with comments where the unauthrozied is occurring.

using Microsoft.Identity.Client;
using System.Net.Http.Headers;
using System.Text.Encodings.Web;
using System.Text.Json;

// based on https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-daemon-dotnet-acquire-token

// entra Tenant ID     = 00000000-f40e-4889-977c-67abc6b1ea17
// az portal Tenant ID = 00000000-f40e-4889-977c-67abc6b1ea17
var tenantId = "00000000-f40e-4889-977c-67abc6b1ea17";

// entra Client ID     = 11111111-0bcf-4861-8430-e5f47abf0972
// az portal Client ID = 11111111-0bcf-4861-8430-e5f47abf0972
var clientId = "11111111-0bcf-4861-8430-e5f47abf0972";

var clientSecret = "secret"; // the client secret obtained from the Microsoft Entra admin center",

// entra Client Object ID =     22222222-289c-4fe2-b53e-a8a3dbe797cf (service principal ID - enterprise app)
// az portal Client Object ID = 22222222-1ace-40d2-9c26-3f9a5a358a03
// not sure why I have two different Object ID's for the application but the azure portal one authenticates and the entra one does not
var clientObjectId = "22222222-1ace-40d2-9c26-3f9a5a358a03";

// entra User Object ID =     33333333-92cf-4c7d-b91b-d017534463d1
// az portal User Object ID = 33333333-92cf-4c7d-b91b-d017534463d1
var userId = "33333333-92cf-4c7d-b91b-d017534463d1";

var authority = $"https://login.microsoftonline.com/{tenantId}";

/**
 * In Azure app permissions - these and many more:
 * Mail.Read = Both Application and Delegated
 * User.Read = Both Application and Delegated
 * Mail.ReadWrite = Both Application and Delegated
 * MailboxFolder.Read = Both Application and Delegated
 * MailboxSettings.Read = Both Application and Delegated
 * Mail.Read.Shared = Delegated
 * Mail.Send = Both Application and Delegated
 */

// This app instance should be a long-lived instance because
// it maintains the in-memory token cache.
var app = ConfidentialClientApplicationBuilder.Create(clientId)
                    .WithTenantId(tenantId)
                    .WithClientSecret(clientSecret)
                    .WithAuthority(new Uri(authority))
                    .Build();

// Acquire token for client credentials flow
var authenticationResult = await app.AcquireTokenForClient(["https://graph.microsoft.com/.default"]).ExecuteAsync();
var bearerToken = authenticationResult.AccessToken;

var httpClient = new HttpClient();
await Authenticate(httpClient, clientObjectId, bearerToken);

// At this point I have successful authentication

await GetMailboxesAsync(httpClient, bearerToken, clientObjectId);  // <== this is where I get unauthorized

await SendEmailAsync(httpClient, userId, bearerToken); // <== this is where I get unauthorized
Console.ReadLine();

static async Task Authenticate(HttpClient httpClient, string clientObjectId, string bearerToken)
{
    using var graphRequest = new HttpRequestMessage(HttpMethod.Get, $"https://graph.microsoft.com/v1.0/applications/{clientObjectId}");
    graphRequest.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearerToken);
    graphRequest.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
    var graphResponseMessage = await httpClient.SendAsync(graphRequest);

    if (graphResponseMessage.StatusCode == System.Net.HttpStatusCode.Forbidden)
    {
        Console.WriteLine("Access denied. Please check the permissions granted to the application.");
        return;
    }

    using var graphResponseJson = JsonDocument.Parse(await graphResponseMessage.Content.ReadAsStreamAsync());
    Console.WriteLine(JsonSerializer.Serialize(graphResponseJson,
        new JsonSerializerOptions { WriteIndented = true, Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping }));
}

static async Task GetMailboxesAsync(HttpClient httpClient, string token, string userId)
{
    // Call the GetMailboxes endpoint to get a list of mailboxes.
    var getMailboxesRequest = new HttpRequestMessage(HttpMethod.Get, $"https://graph.microsoft.com/v1.0/users/{userId}/mailFolders");
    getMailboxesRequest.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token);
    var getMailboxesResponse = await httpClient.SendAsync(getMailboxesRequest);
    if (getMailboxesResponse.StatusCode == System.Net.HttpStatusCode.Unauthorized)
    {
        Console.WriteLine($"Access {getMailboxesResponse.StatusCode}. Why is this unauthorized?");   // <== this is where I get unauthorized
        return;
    }
    if (!getMailboxesResponse.IsSuccessStatusCode)
    {
        Console.WriteLine($"Access {getMailboxesResponse.StatusCode}. ??");
        return;
    }

    getMailboxesResponse.EnsureSuccessStatusCode();

    // Parse the response to get a list of mailboxes.
    var mailboxesJson = await getMailboxesResponse.Content.ReadAsStringAsync();
    var mailboxes = JsonDocument.Parse(mailboxesJson).RootElement;
    foreach (var mailbox in mailboxes.EnumerateArray())
    {
        Console.WriteLine(mailbox.GetProperty("displayName").GetString());
    }

}
static async Task SendEmailAsync(HttpClient httpClient, string userId, string token)
{
    var emailMessage = new
    {
        message = new
        {
            subject = "Test Email",
            body = new
            {
                contentType = "Text",
                content = "Hello, this is a test email!"
            },
            toRecipients = new[]
            {
                new
                {
                    emailAddress = new
                    {
                        address = "******@outlook.com"
                    }
                }
            }
        },
        saveToSentItems = "true"
    };


    var requestContent = new StringContent(JsonSerializer.Serialize(emailMessage)); 
    requestContent.Headers.ContentType = new MediaTypeHeaderValue("application/json"); 
    var request = new HttpRequestMessage(HttpMethod.Post, $"https://graph.microsoft.com/v1.0/users/{userId}/sendMail") 
        { Content = requestContent }; 
    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token);
    var response = await httpClient.SendAsync(request);

    if (response.StatusCode == System.Net.HttpStatusCode.Unauthorized)
    {
        Console.WriteLine($"Access {response.StatusCode}. Why is this unauthorized?");     // <== this is where I get unauthorized
        return;
    }
    if (!response.IsSuccessStatusCode)
    {
        Console.WriteLine($"Access {response.StatusCode}. ??");
        return;
    }

    Console.WriteLine(response.StatusCode);
    Console.WriteLine(await response.Content.ReadAsStringAsync());
}

Anonymous

2025-01-15T07:09:38.6566667+00:00

Hi @We s

Is there anything else I can help you with regarding this issue? If you still need further help, please feel free to let me know. If your question has been solved, then you can click "Accept Answer", which may help members with similar questions find the answer easily. Thank you very much!

Accepted answer

1 additional answer

Your answer

Anonymous

2025-01-15T07:09:38.6566667+00:00

Hi @We s

Is there anything else I can help you with regarding this issue? If you still need further help, please feel free to let me know. If your question has been solved, then you can click "Accept Answer", which may help members with similar questions find the answer easily. Thank you very much!

Answer 1

Anonymous

Hello We s,

Thank you for reaching out to Microsoft Support!

Yes, as you said, sending emails with the Application permissions of the Graph API is not supported by the Home version, you need the Business version account, for which you can view this link.

For Home accounts, you can only Send Mail through the /me/sendMail endpoint, which requires the delegated permission mail.send, for which you need to use auth code flow for an interactive login to get the token.

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.

WesWilliams-4769 65 Reputation points

2025-01-16T19:09:02.5333333+00:00

Microsoft requires a more specific answer than "a Business version account". It turns out that there are 4 such accounts in the link. Will an account with "Exchange" suffice? Or does sending emails require "Entra"? It's a $10/month difference and hopefully exchange suffices.
Anonymous

2025-01-20T09:48:00.0333333+00:00

Yes, the basic version is fine, you need to use Entra, you need to create your app in Entra, you can refer to the link below:

https://learn.microsoft.com/en-us/graph/auth-register-app-v2

https://learn.microsoft.com/en-us/graph/auth-v2-service?tabs=http
WesWilliams-4769 65 Reputation points

2025-01-21T03:07:34.5366667+00:00

I learned that the basic version is only for web and mobile. So I had to buy "Microsoft 365 Apps for business" to run desktop daemons.

Answer 2

Kavya 490

Have you tried using the Send-MgUserMail cmdlet?

https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.users.actions/send-mgusermail?view=graph-powershell-1.0

WesWilliams-4769 65 Reputation points

2025-01-11T19:53:13.41+00:00

Thanks for the reply. Here's what MS had to say: "RSAT is not available on the Home Edition of Windows." So, there's no ActiveDirectory

Share via

What license do I need to be able to send emails through Microsoft Graph via an unattended desktop app?

1 additional answer

Your answer