Unable to retreive messages in office 365 using Invoke-RestMethod with app permission registered in azure AD

Question

I need to be able to read and delete emails in exchange online using REST-API. In my environment it only worked once then now am receiving error 401 upon running the PowerShell script that have created.

What i did set up.
Created an enterprise app in azure AD and assigned API Permission to access office 365 exchange online api under API my organization uses, as shown on attached snips. Retrieved access token for the app using MSAL MODULE Then called invoke-restmethod and passed uri and the auth token to get messages for certain mailbox in office 365.

This worked for once, then rerunning the invoke-restmethod again some minutes later, i get an error 401 unauthorized as shown on attached snip.

I need assistance to understand what could I be missing to make it work again.

Answer 1

Hi @Benard Mwanza ,

You are getting this 401 Unauthorized error because you have not granted microsoft graph permissions to your app instead Office 365 Exachange Online API permissions are granted as per the API permissions screenshot which you shared above.

Please note that you would need to configure the microsoft graph permissions to your app to use Microsoft Graph and below are the steps to be followed to grant Microsoft graph permissions for the registered app in Azure AD.



If you are using application permissions scope in your application then you would have choose "Application Permissons" section from "Microsoft Graph" AP area as shown below



As shown in the above screenshot, Admin must grant admin consent for "Mail.Read" application permissions.

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.

Answer 2

Hi @JanardhanaVedham-MSFT

I had already assigned that permission apologies for not including it in the snips list. Its still the same error.

Answer 3

Hi @JanardhanaVedham-MSFT ,

This has worked like magic thank you, though, have done two additional steps.

Have revoked and removed all office 365 exchange online API permissions. Now the only assigned api permission is for Microsoft graph mail
Granted new permission to admin
Regenerated new access token then called invoke-restmethod again.