Search code examples
c#azureoffice365api

Office 365 API Active Directory Permissions

I am working on behalf of a client and have already set up a wpf application to auto send emails via the office365 api. So I need to set up a new one now. Same customer, same AD entry but a new application. I am using the same code as before, more or less. I keep getting a unauthorized 401. I am setting the permission on the application identically. Two things jump out.

enter image description here

The above keeps appearing, though I managed to get around this before.

Also I see this at the bottom of the AD screen on the portal.

'You are authorized to select only delegated permissions which have personal scope.'

By swapping out the client id to the old application the email sends fine, so it must be due to the AD permissions. They seem very hit and miss as I get the message (picture) but on refresh the tick boxes appear to be ticked and allowed. Very frustrating as I can;t get around and have proven it works with another app and swapping the client id's Any advice would be gratefully accepted. Scotts

Solution

  • What is your role in the Azure AD tenant? I've seen similar issues with my Co-Administrator, where it looks like things go through but then authentication errors. If I create the app and provide him the keys, everything works. This is odd as the information about the role in the documentation states the Co-Administrator has the same permissions as the Service Administrator except for changing the association of the subscriptions to Azure Directories.

    https://msdn.microsoft.com/en-us/library/azure/hh531793.aspx