Microsoft Graph API not able to use mail.read

Question

Within my application I generate an access token via

GET https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/authorize?client_id=<CLIENT_ID>&response_type=code&response_mode=query&scope=user.read+mail.send+mail.readwrite&redirect_uri=https%3A%2F%2Fgraphresponse%2F&prompt=consent

to use the code on

POST https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/token

with application/x-www-form-urlencoded: grant_type=authorization_code&redirect_uri=https%3A%2F%2Fgraphresponse%2F&client_id=<CLIENT_ID>&scope=user.read+mail.send+mail.readwrite&client_secret=<CLIENT_SECRET>&code=<CODE>

So far so good, i receive a bearer token like this (formatted for readability):

{"token_type":"Bearer",
 "scope": 
      "Mail.Read Mail.Read.All Mail.Read.Shared 
       Mail.ReadBasic Mail.ReadWrite Mail.ReadWrite.Shared 
       Mail.Send openid User.Read profile email",
 "expires_in":3600,
 "ext_expires_in":3600,
 "access_token":"<TOKEN>"
}

and I can use the following endpoints

GET http://graph.microsoft.com/v1.0/me 
POST http://graph.microsoft.com/v1.0/me/sendMail 
POST http://graph.microsoft.com/v1.0/me/messages

but I get the following error

GET http://graph.microsoft.com/v1.0/me/messages

{
  "error": {
    "code": "ErrorAccessDenied",
    "message": "Access is denied. Check credentials and try again.",
    "innerError": {
      "request-id": "xxxxxxx",
      "date": "2019-03-12T13:38:47"
    }
  }
}

Did I miss any configuration that is neccessary explicitly to read the current users inbox, or is there any admin configuration required?

Answer 1

As you are trying with authorization code flow so you need follow the below

step to access

https://graph.microsoft.com data.

Note:

1. Make sure you have office 365 user account registered

2. All Required permission grant

As the document explain first you need token request code

response_type = code

To do that there are two ways.

From postman request and From browser with your required credentials

Here I would show postman workaround you could also try it pasting on browser.

Postman Code Access Example

Here make sure in portal you have configure this URL as expected see the below screen shot:

To get v2.0 token request access code set request endpoint to:

https://login.microsoftonline.com/common/oauth2/v2.0/token

Content type to : application/x-www-url-form-urlencoded

See the screen shot below:

Now Click on Authorization tab and select type OAuth 2.0 and click on Get New Access

Token. See the screen shot below:

You Will prompt postman popup like below:

Enter Your necessary information here and click Request Token

In postman console body segment you will get access code for token request. See the screen shot below:

Copy the code for next use.

Now add a new tab on post man for token request like below:

In response you will get you access token like below:

Now with this token request to your expected endpoint for example http://graph.microsoft.com/v1.0/me

See the screen shot below:

In response you will get your endpoint data as expected

See the screen shot below :

If you have any more question just let me know Thank You.