Setting mail message IsRead to true using Graph API fails

Question

When trying to set a mail message IsRead status to true an ODataError is thrown (see exception output below).
Note that we are using the Microsoft.Graph sdk using the "Client credentials provider" Auth provider with a client secret as this needs to run without any user interaction. The Entra application has the Mail.Read, Mail.Send , and Mail.ReadWrite permissions set. We are able to Send and Receive emails just fine.

---

Code example snippet:

var requestBody = new Message
{
    IsRead = true,
};

var msg = graphUser.Messages[message.Id];
try
{
    await msg.PatchAsync(requestBody);
}
catch (Exception e)
{
    Logger.Exception("Unable to mark message as read.", e);
}

---

The same problem happens with the PowerShell Graph SDK:

PS C:\work\testing> Import-Module Microsoft.Graph.Mail 
PS C:\work\testing> Update-MgUserMessage -UserId $userId -MessageId "{message id}" -BodyParameter $params
Update-MgUserMessage : Access is denied. Check credentials and try again.
Status: 403 (Forbidden)
ErrorCode: ErrorAccessDenied
Date:
Headers:
Transfer-Encoding             : chunked
Strict-Transport-Security     : max-age=31536000
request-id                    : d963ff03-946d-45ca-848b-127244e8d86c
client-request-id             : 9f8bf091-970e-4c4c-be44-b476bac58090
x-ms-ags-diagnostic           : {"ServerInfo":{"DataCenter":"South Central US","Slice":"E","Ring":"5","ScaleUnit":"003","RoleInstance":"SN4PEPF0000296D"}}
Cache-Control                 : private
Date                          : Fri, 30 May 2025 21:59:44 GMT
At line:1 char:1
+ Update-MgUserMessage -UserId $userId -MessageId "AAMkADU1YjNjNzM0LTA2 ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: ({ UserId = b565...tGraphMessage }:<>f__AnonymousType5`4) [Update-MgUserMessage_Update], Exception
    + FullyQualifiedErrorId : ErrorAccessDenied,Microsoft.Graph.PowerShell.Cmdlets.UpdateMgUserMessage_Update

$params looks like this:

$params
Name                           Value
----                           -----
isRead                         True

---

Exception:

Microsoft.Graph.Models.ODataErrors.ODataError: Access is denied. Check credentials and try again.
   at Microsoft.Kiota.Http.HttpClientLibrary.HttpClientRequestAdapter.ThrowIfFailedResponseAsync(HttpResponseMessage response, Dictionary`2 errorMapping, Activity activityForAttributes, CancellationToken cancellationToken)
   at Microsoft.Kiota.Http.HttpClientLibrary.HttpClientRequestAdapter.SendAsync[ModelType](RequestInformation requestInfo, ParsableFactory`1 factory, Dictionary`2 errorMapping, CancellationToken cancellationToken)
   at Microsoft.Kiota.Http.HttpClientLibrary.HttpClientRequestAdapter.SendAsync[ModelType](RequestInformation requestInfo, ParsableFactory`1 factory, Dictionary`2 errorMapping, CancellationToken cancellationToken)
   at Microsoft.Graph.Users.Item.Messages.Item.MessageItemRequestBuilder.PatchAsync(Message body, Action`1 requestConfiguration, CancellationToken cancellationToken)

Answer 1

Hello Raleigh Rinehart,

The error occurs if you missed granting admin consent to Mail.ReadWrite Application type permission or you are using Delegated type permission that won't work with client credentials flow.

To resolve the error, make sure to grant Mail.ReadWrite permission of Application type with admin consent as below:

When I ran below PowerShell script to connect with Microsoft Graph using client credentials flow, it worked successfully:

$tenantID = "tenantId"
$appID = "appId"
$secretValue = "secret"
$ClientSecretPass = ConvertTo-SecureString -String $secretValue -AsPlainText -Force
$ClientSecretCredential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $appID, $ClientSecretPass

Connect-MgGraph -TenantId $TenantId -ClientSecretCredential $ClientSecretCredential

$params = @{
    IsRead = $true
}

Update-MgUserMessage -UserId "userId" -MessageId "msgId" -BodyParameter $params

Hope this helps

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful, which may help members with similar questions.

If you have any other questions or are still experiencing issues, feel free to ask in the "comments" section, and I'd be happy to help.

Answer 2

The issue turned out to be that the Mail.ReadWrite permission was added but not yet approved/consented by an Admin. I ask our IT guy to consent to the permission and now all is working as expected.