Microsoft Graph APi users/{email}/messages error: Access is denied. Check credentials and try again

Question

Our org. has an email they made in outlook mail. I'm able to use the Microsoft Graph API using the endpoint me/messages but now I wanted to run this in python (in an azure databricks notebook). So I created a new App in azure portal for this and the only steps I've done otherwise is adding delegated permissions and saving the clientid, secret id, tenant id from there. I have the below code which throws the error:'Access is denied. Check credentials and try again.' Also, I'm able to get a token..

I've added the following delegated permissions...

email ,Mail.Read ,Mail.ReadWrite, User.Read

And this code:

authority = f"https://login.microsoftonline.com/{tenant_id}"
scope = ["https://graph.microsoft.com/.default"]
# scope = ["https://graph.microsoft.com/Mail.Read"]


app = msal.ConfidentialClientApplication(
    client_id,
    authority=authority,
    client_credential=secret_value
)


result = None
result = app.acquire_token_silent(scope, account=None)

if not result:
    print("No suitable token exists in cache. Requesting a new one...")
    result = app.acquire_token_for_client(scopes=scope)

if "access_token" in result:
    print('using access token...')

    headers = {'Authorization': 'Bearer ' + result['access_token']}
    graph_endpoint = f'https://graph.microsoft.com/v1.0/users/{email}/messages'
    response = requests.get(graph_endpoint, headers=headers)

    if response.status_code == 200:
        emails = response.json()
        print(emails)
    else:
        print(f"Error fetching emails: {response.status_code}")
        print(response.json()) 
else:
    print(f"Error acquiring token: {result.get('error')}, {result.get('error_description')}")

Answer 1

The error occurred as you granted permissions of Delegated type which won't work with client credentials flow.

Initially, I too got same error when I ran the code by granting permissions of Delegated type:

To resolve the error, make sure to add Mail.Read permission of Application type by granting admin consent as below:

When I ran the code again after granting permissions of Application type, I got the response successfully like this:

import json
import msal
import requests

tenant_id = "tenantId"
client_id = "appId"
secret_value = "secret"
email = "sri@xxxxxxxxx.onmicrosoft.com"
authority = f"https://login.microsoftonline.com/{tenant_id}"
scope = ["https://graph.microsoft.com/.default"]

app = msal.ConfidentialClientApplication(
    client_id,
    authority=authority,
    client_credential=secret_value
)

result = app.acquire_token_silent(scope, account=None)

if not result:
    print("No suitable token exists in cache. Requesting a new one...")
    result = app.acquire_token_for_client(scopes=scope)

if "access_token" in result:
    print('Using access token...')

    headers = {'Authorization': 'Bearer ' + result['access_token']}
    graph_endpoint = f'https://graph.microsoft.com/v1.0/users/{email}/messages'
    response = requests.get(graph_endpoint, headers=headers)

    if response.status_code == 200:
        emails = response.json()
        print(json.dumps(emails, indent=4))
    else:
        print(f"Error fetching emails: {response.status_code}")
        print(response.json()) 
else:
    print(f"Error acquiring token: {result.get('error')}, {result.get('error_description')}")

Response: