ErrorAccessDenied when using token to send an email.

Question

Hello,

I'm generating an access token by sending a POST to
https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

I'm then trying to send an email by sending a POST to
https://graph.microsoft.com/v1.0/me/sendMail

However I get the error:

{
  error: {
    code: 'ErrorAccessDenied',
    message: 'Access is denied. Check credentials and try again.'
  }
}

When using jws.ms it shows that my token has the role Mail.Send to access that scope
Any idea how I can resolve this?

Thank you.

Answer 1

You are using application permissions to call /me... endpoint which required signed in user (delegated permissions). Because your token has roles claim then you are using application permissions.

To get this to work, if you are using application permissions eg using client credentials flow, then you need to call /user/{id | upn}/sendMail to send email.

If you need to call /me/sendMail, then you need a logged in user and you must add the Mail.Send as a delegated permission then acquire the access token on behalf of user eg using authorization code flow