What scope should be used to connect IMAP store from JAVA application using OAuth 2.0

Question

Hello,
I have a backend application that connects to IMAP store and does some jobs inside. It works fine with basic authentication.
Now we're trying to switch it to OAuth 2.0 but it fails with "A1 NO AUTHENTICATE failed." error on an attempt to connect to IMAP store with a token(we are using Resource Owner Password Credentials flow, due to some reasons we can't use other flows).
After reading a huge number of articles it seems to be related to the scope, we have tried "https://graph.microsoft.com/IMAP.AccessAsUser.All", "IMAP.AccessAsUser.All" and "https://outlook.office.com/IMAP.AccessAsUser.All".
With the first two scopes, it gives us the token but "store.connect("outlook.office365.com", 993, "user@Hanes _domain.onmicrosoft.com", "access_token");" it fails with "A1 NO AUTHENTICATE failed.".
With the last one("https://outlook.office.com/IMAP.AccessAsUser.All") we can't get a token with the "AADSTS65001: The user or administrator has not consented to use the application with ID.." error. That kinda makes sense because we can't add the permissions for Outlook but for Microsoft Graph only.
Please see the token request and the error.




Any ideas are highly appreciated.

Answer 1

Hi @AV

This is an expected error, as your error message states, your administrator has not consent the IMAP.AccessAsUser.All permission of the outlook resource.

You can of course add permissions to outlook, the easiest way is to use the admin consent URL. You just need to run this URL in the browser, then log in with an administrator and consent.

https://login.microsoftonline.com/{tenant id}/v2.0/adminconsent  
        ?client_id={client id}  
        &scope=https://outlook.office.com/IMAP.AccessAsUser.All  
        &redirect_uri={redirect url}  
        &state=12345  

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

@CarlZhao-MSFT
Just to underline and give you all the details. We're attempting to use Microsoft identity platform and OAuth 2.0 Resource Owner Password Credentials flow to make a less as possible changes to the existing code.

Thanks