Application type API permission with Microsoft Graph API

Question

I want to create an app that will list all my emails in Outlook via Microsoft Graph API.

What I did:

1)

Go to "Microsoft Entra ID" (former Active Directory)
Head to "App registrations" -> "New registration"
Select "Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox)" as Supported Account Type.
Create new Client Secret in "Certificates & secrets"
In "Authentication" set "Redirect URIs" to "http://localhost:8000"
Set up permissions "Mail.Read" and "Mail.ReadBasic" along with the default "User.Read" in "API Permissions". The type of the permissions is Application, not Delegated as I want my app to run in the background without any sign-ups.

My Code:

import msal
import requests

client_id = "my_client_id"
tenant_id = "my_tenant_id"
client_secret = "my_client_secret"
redirect_url = f"http://localhost:8000"

authority = f"https://login.microsoftonline.com/{tenant_id}/"
scopes = ["https://graph.microsoft.com/.default"]  # This scope means all permissions granted to the app
app = msal.ConfidentialClientApplication(client_id, client_credential=client_secret, authority=authority)
result = app.acquire_token_for_client(scopes=scopes)
#print(result)

if "access_token" in result:
    access_token = result["access_token"]
    print("Access Token:", access_token)

    # Example of making a request to Microsoft Graph
    headers = {
        "Authorization": f"Bearer {access_token}",
        "Content-Type": "application/json"
    }
    endpoint = "https://graph.microsoft.com/v1.0/users/[email protected]/messages"  # Adjust the endpoint as needed
    response = requests.get(endpoint, headers=headers)

print(f"Error: {response.status_code}, {response.json()}")

I always get: "Error: the client application 'my_client_id' is missing service principal in the tenant 'SOME TENANT ID (it is interesting that this TENANT ID is NOT my teant_id that I specify in the code)'

Mawati · Accepted Answer · 2024-09-13 13:44:50Z

1

One possible cause could be that the tenant ID of your personal outlook email is different than the one you are using for your Azure app.

Not sure if it will help in your case, but someone was able to read from personal Outlook email using delegate access. Microsoft Graph Read Mail from @outlook.com account using app-only authentication

answered Sep 13, 2024 at 13:44

Mawati

371 silver badge10 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

user13 Over a year ago

Thank you for your reply. Do you by any chance know how can I check the tenant ID of my Outlook email?

Mawati Over a year ago

I'm not sure, but the tenant seems to be "common" for personal accounts. learn.microsoft.com/en-us/answers/questions/1276530/…

Community Over a year ago

As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.

Collectives™ on Stack Overflow

Application type API permission with Microsoft Graph API

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related