Office 365 OAuth: Necessary parameters to access mail with "client_credentials" - azure

Question

I am struggling to write a standalone Java backend application which must access an Office 365 mailbox (Outlook mail from MS365 Family account) thru IMAP.
The used OAuth parameters are:
String oAuthAuthorizationURL = "https://login.microsoftonline.com/consumers/oauth2/v2.0/token/";
String oAuthAuthorizationScope = "https://outlook.office365.com/.default";
The OAuth application type is defined as:
Personal Microsoft account users
The API permissions (Graph API) are set to:
IMAP.AccessAsUser.All
Mail.ReadWrite
offline_access
openid
POP.AccessAsUser.All
User.Read
In the application I do get a Bearer Token which is then passed to Jakarta Mail connect() to outlook.office365.com:993.
The result is:
A1 AUTHENTICATE XOAUTH2 dXNlcj1hbmR5....................RWpfQncBAQ==
A1 NO AUTHENTICATE failed.
What am I doing wrong?
Thanks

Answer 1

• Ensure that you have created a ‘client secret’ and mentioned it accordingly in your Java backend application, to access the Office365 mailbox through the Azure AD application registered in Azure AD.
To configure a Java backend application with a client ID and relevant secret, kindly refer to the below link: -
https://www.javainuse.com/spring/springboot-oauth2-client-grant
Then, ensure that the below ‘Application Permissions’ are added under ‘Microsoft Graph’ as API permissions for the Azure AD application: -
Delegated (Work or school account): - Directory.Read.All Application: - Domain.Read.All, Domain.ReadWrite.All, Directory.Read.All
• Also, since you are using Jakarta Mail Connect as a federated app which uses the token from Azure AD to access the Office365 mailboxes, you would need to grant the ‘Delegated Permission’ for ‘EWS.AccessAsUser.All’ under ‘EWS’ section as below as these permissions are necessary for accessing the Office 365 Exchange mailboxes through client credentials flow: -
Also, ensure that ‘Mail.Read, Mail.ReadBasic, Mail.ReadBasic.All, Mail.ReadWrite, Mail.Send, MailboxSettings.Read, MailboxSettings.ReadWrite, Calenders.Read, Calenders.ReadWrite, Contacts.Read, Contacts.ReadWrite’ delegated permissions are assigned to Microsoft Graph API for that Azure AD app registered.
Thus, when you configure the above, successful authentication should happen for your Jakarta Mailconnect app through Java backend application.
For more information, kindly refer to the below link: -
https://learn.microsoft.com/en-us/answers/questions/658248/azure-applicaiton-for-access-to-from-specific-appl.html