Actionable Email - Azure Ouath

[rushikeshvartak]

We are setting up actionable email approval with Microsoft Azure ouath 

We have provided SPN access to read mailbox but we are getting access denied error.

{"error":{"code":"ErrorAccessDenied","message":"Access is denied. Check credentials and try again."}}

Mailbox have required access.

Part of issue was to avoid giving that API access to the SP because it shouldn't be allowed to read everyone's mailboxes.  

https://learn.microsoft.com/en-us/graph/auth-limit-mailbox-access

[sudeshjaiswal]

Hello @rushikeshvartak,

Does it work, when you give the full access?

Thanks

[rushikeshvartak]

No

[CR]

User ID is missing

[sudeshjaiswal]

Hello @rushikeshvartak,

Please validate if the below persmissions are granted: 

Following are the permissions required to read the mailbox messages. These permissions are for applications.

Assign the required permissions in Azure AD by following the steps mentioned in above section. The following permissions are required for reading emails.

• Mail.Read

• Mail.ReadBasic

• Mail.ReadBasic.All

• Mail.ReadWrite

• Mail.Send
  
  
  For Ref : https://docs.saviyntcloud.com/bundle/EIC-Admin-v24x/page/Content/Chapter06-EIC-Configurations/Settin... 
  
  Thanks,

[rushikeshvartak]

As mentioned initially client is not ready to provide Mail.Read access as service account can read everyone's mailbox. We have explicitly provided SPN to access individual account .

As per confirmed by TAM this is feasible we are waiting for documentation around same

@CR  USERID has been removed from screenshot

[rushikeshvartak]

@sudeshjaiswal  Any update

[sudeshjaiswal]

Hello @rushikeshvartak,

Currenlty this is not feasible, you need to grant all the permission as mentioned in the document.

Thanks.

[rushikeshvartak · Accepted solution]

Documentation has additional privileges which should be removed.

Our use case is resolved with Mail.Read

Documentation needs to removed below permission :

• Mail.ReadBasic.All -->Not required to provide access to read everyone's mailbox in orgnization

• Mail.Send >> Not needed as we don't send email from mailbox such request approval already prcoessed.

1. Mail.Read:

   • This permission scope grants the application the ability to read mail that the signed-in user can access. It includes the user's own mailbox and any shared mailboxes they have access to. It allows reading all mail messages in the signed-in user's mailbox, including their body, subject, and any attachments.

2. Mail.ReadBasic:

   • This permission scope grants the application the ability to read a basic set of mail data from the signed-in user's mailbox. It includes only a subset of mail properties, such as the message subject and sender, but does not include the message body or attachments. This scope provides access to a limited set of mail data for scenarios where full access is not required.

3. Mail.ReadBasic.All:

   • This permission scope grants the application the ability to read a basic set of mail data from all mailboxes in the organization without a signed-in user. It provides access to a limited set of mail properties across all mailboxes in the organization, similar to Mail.ReadBasic, but without requiring a signed-in user.

4. Mail.ReadWrite:

   • This permission scope grants the application the ability to read, create, and update mail in the signed-in user's mailbox. It includes the ability to read and modify existing mail messages, create new messages, and update message properties such as the subject, body, and recipients.

5. Mail.Send:

   • This permission scope grants the application the ability to send mail on behalf of the signed-in user. It allows the application to create and send new mail messages from the user's mailbox, using their identity as the sender.

[sudeshjaiswal]

Hello @rushikeshvartak,

Thank you for providing detailed information. You have the option to share your feedback on the documentation portal and also, you can create a Knowledge Base Article.
This would greatly benefit end users who may have similar use cases.

Thanks.

[rushikeshvartak]

Only Employees are allowed to create KB and feedback is provided with forum link & also inform TAM