Non-Interactive Authentication Using the Client Credential Flow

[Lilit0x]

Hi there. I am attempting to automate the retrieval of emails from a Microsoft 365 account using the SDK. I have successfully obtained the access token via the client secret flow with this straightforward code:

  let confidential_client = ConfidentialClientApplication::builder(&*self.client_id)
                    .with_client_secret(secret)
                    .with_tenant(&*self.tenant_id)
                    .build();
    GraphClient::from(&confidential_client)

However, the problem arises when trying to fetch the email folders; invoking /me comes first:

        let res = self
            .graph_client
            .me()
            .mail_folders()
            .list_mail_folders()
            .send()
            .await
            .with_context(|| {
                "[ingest_imap]: microsoft_365. Failed to send request to fetch mail folders"
            })?;

This attempt fails with the error /me request is only valid with delegated authentication flow, indicating that the access token obtained through the client credential flow, which does not require user interaction, lacks the necessary permissions to call /me.

Is there a way within the SDK to obtain a non-interactive access token that contains sufficient permissions to access a user's email folders?
Thank you.

[sreeise]

Hi there. I am attempting to automate the retrieval of emails from a Microsoft 365 account using the SDK. I have successfully obtained the access token via the client secret flow with this straightforward code:

  let confidential_client = ConfidentialClientApplication::builder(&*self.client_id)
                    .with_client_secret(secret)
                    .with_tenant(&*self.tenant_id)
                    .build();
    GraphClient::from(&confidential_client)

However, the problem arises when trying to fetch the email folders; invoking /me comes first:

        let res = self
            .graph_client
            .me()
            .mail_folders()
            .list_mail_folders()
            .send()
            .await
            .with_context(|| {
                "[ingest_imap]: microsoft_365. Failed to send request to fetch mail folders"
            })?;

This attempt fails with the error /me request is only valid with delegated authentication flow, indicating that the access token obtained through the client credential flow, which does not require user interaction, lacks the necessary permissions to call /me.

Is there a way within the SDK to obtain a non-interactive access token that contains sufficient permissions to access a user's email folders? Thank you.

Yeah so when using non-interactive auth flows you will want to use the /users/{user-id} for that instead of /me. Both /users/{user-id} and /me support almost all of the same APIs including mail folders. The differece being you need the user id beforehand.

let result = client
        .user("USER_ID")
        .mail_folders()
        .list_mail_folders()
        .send()
        .await;

You will need to update your application permissions to be able to use the /users endpoints and do any required admin consent.

The Microsoft documentation for /me has some more context on this in the permissions section if it helps: https://learn.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0&tabs=http#permissions