EWS Error "Access is denied. Only the subscription owner may access the subscription" Since 01.02.2021

Question

Hello,
we have a problem with EWS subscriptions since 02/01/2021.
This has worked for many years so far.
As far as I know, the problem affects all customers who use office365 Exchange.

We have an Exchange Admin user who has full access to a specific user mailbox.
With the help of the EWS Managed API (https://github.com/OfficeDev/ews-managed-api) I create a subscription to a user mailbox in order to regularly ask for new emails that have landed in the mailbox.

When calling GetEvents(), however, the error message "Access is denied. Only the subscription owner may access the subscription" has recently appeared.

I isolated the problem in C #:

using Microsoft.Exchange.WebServices.Data;
.....
private void btnDummy_Click(object sender, EventArgs e)
        {
            var adminUser = "admin@test.com"; //Admin User. Who has full access to user1
            var adminPass = "password"; //<- App Password
            var mailBoxToSubscribeTo = "user1@test.com";  //Another User. Not admin User!
            var folderDisplayName = "Inbox"; //Mailboxfolder to Subscribe to

            //Initilize Service Client API
            ExchangeService service = new ExchangeService(ExchangeVersion.Exchange2013_SP1);
            service.Url = new Uri("https://outlook.office365.com/EWS/Exchange.asmx");
            service.TraceEnabled = true;
            service.TraceFlags = TraceFlags.All;
            service.Credentials = new WebCredentials(adminUser, adminPass);

            //Get Mailbox Folder to Subscribe to
            FolderId fi = new FolderId(WellKnownFolderName.MsgFolderRoot, new Mailbox(mailBoxToSubscribeTo));
            Folder rootfolder = Folder.Bind(service, fi);
            rootfolder.Load();
            FolderId InboxId = null;
            foreach (Folder fo in rootfolder.FindFolders(new FolderView(255)))
            {
                if (fo.FolderClass == "IPF.Note")
                    if (fo.DisplayName == folderDisplayName)
                    {
                        InboxId = fo.Id.UniqueId;
                        break;
                    }
            }
            if (InboxId == null)
                throw new Exception($"Folder {folderDisplayName} not found in {mailBoxToSubscribeTo}");

            //Subscribe to mailbox folder
            PullSubscription subscription = service.SubscribeToPullNotifications(
                folderIds: new FolderId[] { InboxId },
                timeout: 60,
                watermark: "",
                eventTypes: new EventType[] { EventType.NewMail, EventType.Moved, EventType.Created, EventType.Copied });
            try
            {
                GetEventsResults events = subscription.GetEvents(); //<- Crash here: ServiceResponseException: 'Access is denied. Only the subscription owner may access the subscription.'

                //.............
            }
            finally
            {
                subscription.Unsubscribe();
            }
        }

Does anyone know what has changed in exchange online recently? Is this just a temporary problem? As I said, it always worked until recently.

Answer 1

I think i found a solution.

            var mailBoxToSubscribeTo = "praktikant@blabla.com";  //Not adminUser!
            ...
            try
            {
                service.HttpHeaders["X-AnchorMailbox"] = mailBoxToSubscribeTo; //<- FIX
                GetEventsResults events = subscription.GetEvents(); 
                //.............
            }
            finally
            {
                subscription.Unsubscribe();
            }

I have to test this more closely, but so far it looks good.