5

Using Postman, I am trying to retrieve the last emails received in my Outlook mailbox.

To achieve this, I have declared my app in the App Portal. Then, I can do a GET request to get a token from the endpoint: 

https://login.microsoftonline.com/[tenantId]/oauth2/token

Next, I try to use the token I received to perform a request at 

https://graph.microsoft.com/v1.0/me/mailfolders/inbox/messages

The problem is that the API returns: 

{
  "code": "NoPermissionsInAccessToken",
  "message": "The token contains no permissions, or permissions can not be understood.",
}

In the permissions of my app, I have authorized every action related to reading emails. Am I missing something?

Marc LaFleur
  • 31,987
  • 4
  • 37
  • 63
Roatha Chann
  • 435
  • 6
  • 21
  • 1
    Welcome to Stack Overflow! I strongly recommend reading ["How do I ask a good question?"](https://stackoverflow.com/help/how-to-ask) for some tips on getting started. You're missing a lot of key details in your question: Which scopes exactly did you register for? How exactly did you call `/token`? Did you get "Admin Consent" for this app? – Marc LaFleur Apr 08 '19 at 15:35

3 Answers3

7

I was actually missing admin approval for the scopes (read.mail in my case). In a App-Only usage, you need to get approval from admin. To do so, admin must use this url:

https://login.microsoftonline.com/common/adminconsent?client_id=[your_client_id]&state=[random_string]&redirect_uri=http://localhost/

Admin will be prompt to approve permissions.

Roatha Chann
  • 435
  • 6
  • 21
6

This sounds like you forgot to "Grant permission" (it happens to the best of us :P).

Grant the permission for your tenant. The easiest way is through https://portal.azure.com -> Azure AD -> App Registrations -> Your App -> Settings -> Required permissions -> Button Grant Access.)

Related to this answer

It also helps to take the token, and paste in into https://jwt.ms which will show you all the data in the token (and should also show the claims about the granted permissions).

Stephan
  • 2,356
  • 16
  • 38
0

The exception is the API to find meeting times or send mail, which applies to only Office 365 mailboxes (on Azure AD) and not to Microsoft accounts.

For simplicity of reference, the rest of this article uses Outlook.com to include these Microsoft account domains.

https://learn.microsoft.com/en-us/previous-versions/office/office-365-api/api/version-2.0/calendar-rest-operations

Kiran Kawade
  • 79
  • 4