Answered

Send mail as user via Graph API (app registration) with delegated permission

(0) Share

Report

Posted on by cgru3eejc2

Hi,

I'm trying to implement a Logic App (or Flow) which can send e-mails in the name of the caller (another user). So a user calls a Flow or Logic app we built with an own Flow. So the user is known and his access token could be “transferred”.

When I create an app (App registration) with application permission for the Graph Mail.Send API this works.

With delegated permission I did not succeed to implement it.

Even when getting the OAuth token first for the caller user I only get a NoPermissionsInAccessToken when calling the App to send.mail via Graph API:

"code": "NoPermissionsInAccessToken",

"message": "The token contains no permissions, or permissions can not be understood.",

Found this blog where similar behavior is mentioned and the alternatives are not really possible or good.

https://stackoverflow.com/questions/56495738/retrieve-oauth-2-0-authorization-code-without-user-interaction

Do you have any hint how to implement a generic "Send As" in delegation of a user with Flow or Logic Apps (not using a shared mailbox and give send as permission).

Is application permission really the only way?

Regards,

Stefan

Categories:

Using connectors

I have the same question (0)

All responses (4)

Answers (1)

v-litu-msft Microsoft Employee on at

Like (1)

Report
Copy link

Link copied!

Hi @cgru3eejc2,

I am afraid you could not use the Graph API to send an email on behalf of others, you will only be able to send emails from an email account that you have been given delegate access to.

Please refer to the following document:

https://docs.microsoft.com/en-us/graph/permissions-reference#mail-permissions

Best Regards,
Community Support Team _ Lin Tu
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

Was this reply helpful? Yes No
cgru3eejc2 74 on at

Like (0)

Report
Copy link

Link copied!

Thanks @v-litu-msft

Is it the same for Mail.Send?

So otherwise it can only be done via app permission?

Regards,
Stefan

Was this reply helpful? Yes No
Verified answer

v-litu-msft Microsoft Employee on at

Like (0)

Report
Copy link

Link copied!

Hi @cgru3eejc2,

Yes, you can create other connections in the Flow. For instance, you could create a Flow with multiple Email connection, then email will send as the connection account.

Best Regards,
Community Support Team _ Lin Tu
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

Was this reply helpful? Yes No
itpropro 2 on at

Like (0)

Report
Copy link

Link copied!

This is the wrong answer, the initial question asked for "send as" or service principal authentication, which is both not possible with connectors.
As long as this flaw is existent, you have to use the graph HTTP request action with service principal auth.

Was this reply helpful? Yes No