This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(198.4, 61%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ES%3C/text%3E%3C/svg%3E)
Hi Everyone,
I have a in-house .net app which needs to connect to a Office365 mailbox to scrape emails (read and delete).
I don't want the app to use legacy authentication (username + password).
I know I can leverage AZ AD Enterprise Apps and grant permissions and then link the Enterprise app to the .net app.
My question is which Microsoft Graph permissions should I grant?
I looked in there and I think I need:
Mail.ReadWrite Read and write access to user mail Allows the app to create, read, update, and delete email in user mailboxes. Does not include permission to send mail
Can I grant this permissions to a single account?
Are there other defaults permissions required?
Thanks, M
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(25.6, 67%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJS%3C/text%3E%3C/svg%3E)
Hi @SenhorDolas
Do suggestions below help? Feel free to share your update here
If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
I guess, granting following permissions should help
I have created a similar post in my blog for your reference here: create-custom-folder-in-exchange-online-mailboxes-using-graph-api-using-windows-powershell
----------
If the Answer is helpful, please click "Accept Answer" and upvote it
But @Manu Philip
From your blog I see that the permission is applied to ALL Mailboxes.
I want to apply to just one mailbox and not grant admin consent from my domain.
Is this possible?
Thanks, M
There are two models you can use with Graph API: delegate permissions and application permissions. For the former, your app runs in the context of a given user, and the permissions it has are the subset of permissions granted to the user and the permissions granted to the app. Thus, the application will only be able to access mailboxes that the given user can access, which usually is just his own mailbox (but he might also have been granted permissions on other mailboxes). This is the most appropriate approach for your case.
In the application permissions model, there is no user context and the application gets access to all mailboxes in the directory. The only way to restrict such permissions are the so-called application access policies: https://practical365.com/application-access-policies-in-exchange-online/
Do note however that some operations/Graph API endpoints can only be performed by certain type of permissions, not all. So it will also depend on what your applications needs to do.