Microsoft Graph API, DELETE request response, "Access is denied. Check credentials and try again."

Abe Shaker 26

Hello. I'm working on a short shell script to remove e-mails from three different inboxes. Our M365 admin successfully registered, configured and authorized an app which allows us to get an access token via script.

We can read e-mails successfully from all three accounts but cannot delete e-mails. The admin has confirmed that the API does have the Mail.ReadWrite permission as mentioned here. When I test this out on my own account using my own token it works fine. Is there another permission needed in order to do this? Thank you.

curl -X DELETE -H "Authorization: Bearer $AccessToken" "https://graph.microsoft.com/v1.0/me/messages/$EmailID"

Danstan Onyango 3,821 Reputation points Microsoft Employee

2021-03-18T16:48:50.363+00:00

How are you acquiring the access token from the script. what error do you get when you try to delete using the access token acquired via the script?
Abe Shaker 26 Reputation points

2021-03-18T19:16:40.033+00:00
Hi. We're acquiring the token via curl (sample below). The output is a token, which is working great to read e-mail, but we cannot delete e-mails w/ the same token. We've confirmed that the app does have the Mail.ReadWrite permission. Since we're interfacing w/ more than one account, would the Mail.ReadWrite.Shared permission need to be set?

The error we get is, "{"error":{"code":"ErrorAccessDenied","message":"Access is denied. Check credentials and try again."}}"

curl -X POST -H "Content-Type: application/x-www-form-urlencoded" --data-urlencode "client_id=<client_id>" --data-urlencode "scope=https://graph.microsoft.com/.default" --data-urlencode "client_secret=client_secret" --data-urlencode "grant_type=client_credentials" "https://login.microsoftonline.com/<tenant>/oauth2/v2.0/token"
Danstan Onyango 3,821 Reputation points Microsoft Employee

2021-03-19T04:59:02.977+00:00

I have left an answer that should help. Please accept and upvote to help other community users

Accepted answer

Danstan Onyango 3,821 Reputation points Microsoft Employee

2021-03-19T04:54:23.527+00:00

You can not use the token acquired using client_credentials grant type to call the /me and all its extensions because they required delegated permissions(signedin user). See here

Since you are using application permissions, you need to use https://graph.microsoft.com/v1.0/users/{user-id}/messages/{message-id} or any endpoint here that has no /me
Please sign in to rate this answer.

2 people found this answer helpful.
Abe Shaker 26 Reputation points

2021-03-19T19:40:52.82+00:00

This worked perfectly! Thank you! The final curl statement looks like this:

curl -X DELETE -H "Authorization: Bearer $AccessToken" "https://graph.microsoft.com/v1.0/users/$UserID/messages/$MessageID"
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Microsoft Graph API, DELETE request response, "Access is denied. Check credentials and try again."

0 additional answers

Your answer