What scope should be used to connect IMAP store from JAVA application using OAuth 2.0

Question

I have a backend application that connects to IMAP store and does some jobs inside. It works fine with basic authentication. Now we're trying to switch it to OAuth 2.0 but it fails with "A1 NO AUTHENTICATE failed." error on an attempt to connect to IMAP store with a token(we are using Resource Owner Password Credentials flow, due to some reasons we can't use other flows). After reading a huge number of articles it seems to be related to the scope, we have tried "https://graph.microsoft.com/IMAP.AccessAsUser.All", "IMAP.AccessAsUser.All" and "https://outlook.office.com/IMAP.AccessAsUser.All". With the first two scopes, it gives us the token but "store.connect("outlook.office365.com", 993, "user@some_domain.onmicrosoft.com", "access_token");" it fails with "A1 NO AUTHENTICATE failed.". With the last one("https://outlook.office.com/IMAP.AccessAsUser.All") we can't get a token with the "AADSTS65001: The user or administrator has not consented to use the application with ID.." error. That kinda makes sense because we can't add the permissions for Outlook but for Microsoft Graph only. Any ideas are highly appreciated.

Answer 1

I guess the correct scope is https://outlook.office.com/IMAP.AccessAsUser.All

In the app registration screen in the azure portal, you can add common used api permissions. You can also take a look at the second tab where you can add additional api like outlook.

You then need the application id, to find the correct one, go to enterprise applications, switch the filter to Microsoft applications and look for exchange. I’m on my iPad, so it doesn’t work well here, but you should be able to find the correct ID there.

Apart from that, imap needs to be enabled in your organization and access should not be permitted through conditional access.

Second advise, consider migrating to graph api. That is the way forward for all new applications.