Send mail as user via Graph API (app registration) with delegated permission

[cgru3eejc2]

Hi,

I'm trying to implement a Logic App (or Flow) which can send e-mails in the name of the caller (another user). So a user calls a Flow or Logic app we built with an own Flow. So the user is known and his access token could be “transferred”.

When I create an app (App registration) with application permission for the Graph Mail.Send API this works.

With delegated permission I did not succeed to implement it.

Even when getting the OAuth token first for the caller user I only get a NoPermissionsInAccessToken when calling the App to send.mail via Graph API:

"code": "NoPermissionsInAccessToken",

"message": "The token contains no permissions, or permissions can not be understood.",

Found this blog where similar behavior is mentioned and the alternatives are not really possible or good.

https://stackoverflow.com/questions/56495738/retrieve-oauth-2-0-authorization-code-without-user-inte...

Do you have any hint how to implement a generic "Send As" in delegation of a user with Flow or Logic Apps (not using a shared mailbox and give send as permission).

Is application permission really the only way?

Regards,

Stefan

[v-litu-msft]

Hi @cgru3eejc2,

I am afraid you could not use the Graph API to send an email on behalf of others, you will only be able to send emails from an email account that you have been given delegate access to.

Please refer to the following document:

https://docs.microsoft.com/en-us/graph/permissions-reference#mail-permissions

Best Regards,
Community Support Team _ Lin Tu
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[cgru3eejc2]

Thanks @v-litu-msft

Is it the same for Mail.Send?

So otherwise it can only be done via app permission?

Regards,

Stefan

[v-litu-msft · Accepted solution]

Hi @cgru3eejc2,

Yes, you can create other connections in the Flow. For instance, you could create a Flow with multiple Email connection, then email will send as the connection account.

Best Regards,
Community Support Team _ Lin Tu
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[itpropro]

This is the wrong answer, the initial question asked for "send as" or service principal authentication, which is both not possible with connectors.

As long as this flaw is existent, you have to use the graph HTTP request action with service principal auth.