Search code examples
permissionsazure-active-directorymicrosoft-graph-apiazure-app-registration

Microsoft Graph Send Mail Shared Mailbox Access is denied. Check credentials and try again

Ive registered an Azure AD application with the API permissions of "Mail.Send" and "Mail.Send.Shared". The intention is to send emails from, and maybe to, a shared mailbox.

When I try to send an email, I get the following error

{
    "error": {
        "code": "ErrorAccessDenied",
        "message": "Access is denied. Check credentials and try again."
    }
}

This is what I'm using to the Oauth token

Post https://login.microsoftonline.com/xxx/oauth2/v2.0/token

enter image description here

and to send the email

Post https://graph.microsoft.com/v1.0/users/<shared mailbox>/sendMail

Body

{
  "message": {
    "subject": "Can I send emails from Postman?",
    "Sender":{
       "EmailAddress":{
          "Name":"<shared mailbox email address>",
          "address":"<shared mailbox email address>"
       }
    },
    "body": {
      "contentType": "Text",
      "content": "Testing from Postman."
    },
    "toRecipients": [
      {
        "emailAddress": {
          "address": "[email protected]"
        }
      }
    ]
  },
  "saveToSentItems": "false"
}
Solution

  • Your using the Client_Credentials flow but it looks like your assigning delegate permissions. Mail.Send.Shared is a delegate only permission and Mail.Send is both a delegate and application permission. The only permission you can use in the client credentials flow is the Application permission Mail.Send https://learn.microsoft.com/en-us/graph/permissions-reference#application-permissions-43 eg enter image description here

    Also even if you are trying to SendAS the Shared mailbox using delegate permission then you don't ever set the Sender you need to use the From Address and Exchange will automatically adjust this depending on the permissions of the mailbox this is explained in https://learn.microsoft.com/en-us/graph/outlook-send-mail-from-other-user