MailboxNotEnabledForRESTAPI error in multi-tenant app, but works in Graph Explorer

Question

I have a multi-tenant Azure AD application with all required Microsoft Graph permissions (Mail.Send, Mail.ReadWrite, etc.) granted and admin consent provided. The app is also publisher verified.

I’m using OAuth (authorization code flow) to acquire tokens and calling:

POST https://graph.microsoft.com/v1.0/me/sendMail

The issue is:

For some users from external tenants, the API returns:

MailboxNotEnabledForRESTAPI

These users are able to authenticate successfully.

They confirm that their mailbox is active, working and have valid M365 licence.

I also verified that required scopes are present in the access token.

However:

When I test the same API using Graph Explorer, it works successfully for those same users.

In Azure portal, I noticed that these users appear as Guest users in my tenant.

1. Why does sendMail fail with MailboxNotEnabledForRESTAPI from my app but succeed in Graph Explorer?
2. What is the correct way to ensure sendMail works for users from external tenants in a multi-tenant setup?

Answer 1

1. Reason for the MailboxNotEnabledForRESTAPI difference

The error MailboxNotEnabledForRESTAPI indicates that the mailbox being targeted is not enabled for REST API connectivity in the tenant where that mailbox actually lives. This typically happens when:

• The mailbox does not have an Exchange Online license,
• The mailbox is disabled, or
• The mailbox is in an on‑premises or hybrid Exchange environment that is not exposed via the Outlook/Graph REST APIs.

From the context:

This issue occurs because the Exchange mailbox associated with the email address isn't enabled for REST API connectivity in the Microsoft 365 tenant relative to the configured email server profile. This issue can occur if the mailbox doesn't have an Exchange Online license, is disabled, or exists in an Exchange on-premises hybrid deployment.

and

This error can occur if the mailbox is on a dedicated Microsoft Exchange Server and is not a valid Microsoft 365 mailbox.

Why Graph Explorer works while the app fails:

• Graph Explorer runs in the user’s home tenant and uses that tenant’s configuration and policies.
• In a multi‑tenant app scenario, the app is registered in one tenant but is used by users from external tenants. Those external users show up as guest users in the app’s home tenant, but their mailbox and REST enablement are controlled by their own home tenant.
• If the external user’s mailbox is not fully enabled for REST in their home tenant (for example, hybrid/on‑premises, or not a valid Microsoft 365 mailbox), calls that rely on REST mailbox access from your app will fail with MailboxNotEnabledForRESTAPI, even though the same user can sign in and Graph Explorer may be using a different path or configuration in their own tenant.

In short, the error is about the mailbox’s Exchange configuration in the user’s home tenant, not about your app’s Graph permissions. Graph Explorer succeeds because it is executing under conditions where the mailbox is recognized as REST‑enabled; your app fails when the mailbox is not REST‑enabled from the perspective of the Exchange Online environment backing that user.

2. How to ensure sendMail works for external users in a multi‑tenant setup

To make sendMail work reliably for users from external tenants:

1. Ensure the mailbox is a valid Exchange Online mailbox and REST‑enabled in the user’s home tenant:
   • The user must have an appropriate Exchange Online license assigned.
   • The mailbox must not be disabled.
   • The mailbox must not be only on an on‑premises or dedicated Exchange server that is not exposed via Outlook/Graph REST.
   • If the mailbox is in a hybrid deployment, the tenant’s Exchange configuration must support REST access for that mailbox.
2. If the mailbox is not REST‑enabled, the only fix is on the external tenant side:
   • The external tenant’s Exchange administrator must migrate or provision the mailbox as a valid Microsoft 365 mailbox in Exchange Online.
   • From the context:
     • “To get a valid Microsoft 365 mailbox, submit a request to your Exchange administrator to migrate the mailbox account.”
3. Validate with the external tenant admin:
   • Ask the external tenant admin to confirm:
     • The user has an Exchange Online mailbox (not just a license assigned but actually a provisioned mailbox in EXO).
     • The mailbox is not on a dedicated or on‑premises Exchange server only.
4. Application‑side considerations:
   • Multi‑tenant registration and Graph delegated permissions (Mail.Send, Mail.ReadWrite, etc.) are necessary but not sufficient; they do not override the mailbox’s REST enablement state.
   • As long as the mailbox is not REST‑enabled in the user’s home tenant, no multi‑tenant app configuration can make sendMail succeed.

In practice, the correct pattern is:

• Use a multi‑tenant app with delegated Mail.* permissions and admin consent where required.
• For each external user that encounters MailboxNotEnabledForRESTAPI, coordinate with that user’s home tenant admin to ensure the mailbox is a valid Exchange Online mailbox and enabled for REST (or migrated to Exchange Online if currently on dedicated/on‑premises Exchange).

---

References:

• Error code 8005E274 when you test and enable mailbox
• REST API is not yet supported for this mailbox error for request to a mailbox