Search code examples
azureexchangewebservices

EWS API to get folder using AUTH returned Token in JAVA

We are trying to authenticate through Azure AD and return a token to do a call using EWS API.

if my scope https://outlook.office365.com/EWS.AccessAsUser.All/.default then it returns "com.microsoft.aad.msal4j.MsalServiceException: AADSTS500011: The resource principal named https://outlook.office365.com/EWS.AccessAsUser.All was not found in the tenant named company. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant."

If my scope https://outlook.office365.com/.default then it returns The request failed. The request failed. The remote server returned an error: (403)

Not sure if API permission is incorrect or something on my code?

App registration API permissions (https://i.sstatic.net/kDhjI.png)

Java Code

I was expecting to authenticate and EWS API returns a list of folders.

Solution

  • For the delegated authentication the correct scope is

    https://outlook.office365.com/EWS.AccessAsUser.All

    you should not have /.default at the end that will make the scope invalid which is why your getting the error.

    In the link you provided for the code it show you using the client credentials flow however in your permission list you don't list any application permissions. For EWS to use the client credentials flow you need to have the full_access_as_app permission eg enter image description here

    The scope you then would use is

    https://outlook.office365.com/.default

    If you can't find the application permission in the UI you can add it by modifying the manifest see app only authentication in https://learn.microsoft.com/en-us/exchange/client-developer/exchange-web-services/how-to-authenticate-an-ews-application-by-using-oauth