Office 365租户Access Token调用邮件接口401问题排查

数据老陈

2026-6-29

问题描述

我正在开发一款Office插件，使用Office Dialog实现登录功能，代码如下：

var url = "https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=myclientid&response_type=token&redirect_uri=https://localhost:3000/assets/Redirect.html&scope=user.read%20mail.readwrite%20mail.send&response_mode=fragment&state=12345&nonce=678910";
Office.context.ui.displayDialogAsync(url, {  height: 60, width: 40 }, function (asyncResult) {
Logindialog = asyncResult.value;
Logindialog.addEventHandler(Office.EventType.DialogMessageReceived, function (arg) {
  token = arg.message;
  });
});

登录成功后，通过redirect.html中的以下代码获取token：

var address_Link = window.location.href;
 console.log(address_Link)
 var address_arr = address_Link.split("=");
 var address_Token = address_arr[1];
 var Id_Token = address_Token.split("&");
 var access_token = Id_Token[0];
 console.log(Id_Token);
 Office.onReady(function (appInfo) {    
  Office.context.ui.messageParent(JSON.stringify(access_token));
 })

普通微软账户获取的token：

EwCoA8l6BAAUs5%2bHQn0N%2bh2FxWzLS31ZgQVuHsYAASzDAo%2bzOHW8bimiwipl3VtTsk4JI1MUN2Osop4ryl1wGSRhZypgzfO/ff1zkOGAzStT4BsAzkSOV/0LiCtQ2MTB2RsR1%2buhflh3Pq2CwOawwTS7nj/%2bKnDFvH3N9h6N8uwruiEH4OZekE0gfk4fOfY2Go5IgrWUfbs%2bjcbNXKGv/Ekc4PeSXNaII5mCyBjLVuvxvLHhrZzAL7tu8AxCFyd5XxAWP6pXjJRZk7ow0ChUQeNNPNP5/rWSTLBbMu3AORmKIi%2bvfdvVcxhmmQmpAgU4glN6BIR7gKj6pkvhKQVydGIvTPvFlLOvWJItF5um8ignPEgP43gMqmPsH07xFJcDZgAACBbA8fXreaJdeAK%2bseTrYHH7KxKhAhPIN2sZUfAZKPHjuoPqhQopFvQFxWUljFOlJzHWn00pHbW3pVm95S58HngtIYDzNg9uKqIm9O3VJdrwctgnsDA5cMNPFzyOb3nYh58BSdefe3c42D1n7ovKtUjKtQR%2b5zJrocarrhwXhYLvXbAg2kMliEc1zqiCbyH6ila5s63mWaoufy%2bFnPkW9nyQ2qaTfqWgFa0tHlaNgWf9a2j5zlLUFTvaw9zLRtilFLWoOv1FMfEzw/A7WaebYW4DHCOeMJIkd2NjHGtqg3kXj0cXf1Jt2xQnoIG8vR5w%2bzqI/tfqMAMkJSOSGCLRdjNjUadF8NNYFbzoLX8TPeYarwHWJRbXBUtbBhOpRJE/DTwaJh800AcUBM6y5v1bFnRBWtdAYtrlefL0lQT2FodrcpcVH9AAao2ks2EQa0Xla8D39dYDcGqQ1mg3VCzjz7qNlhnIP6D30oL%2bzM8oTjjZahKE62ISPcpWEVTPQ3s7CddKYR6TJ86xmLGqTedK1u5xypHopSXTRzCbLvu6pGaKZy%2bacDVwT8YzABbZfGYdZnmh6CDfoYubYI924O0r22XC1rtrdGv9ghCDkZEcGIIiJelTiTRpgP/QDHlXW2Qci4gwRUK3cIYCTQds9Z2PA6sn3iDpa/Sf8vyaQZ1m99Rek8mVifBkGxOr2O7t5Tzq69sBOMylz7y7SvWlHEgqpC%2bSQ3/eQX6wcOEbrdldqFA5yu%2bqm0bANF5RIc1L7AZo/PagLt1DmAILJKIxomQ5pTelqeXpAKUM4qN%2b4ym4TKhINqNAnks4rd4/1aLeVG9o%2bZG98f6ePdGKf4MC9%2boSKewl2qgC

Office 365租户账户获取的token：

eyJ0eXAiOiJKV1QiLCJub25jZSI6IkJneVFGOVVSTm5RSlh4end2MTlsTGV6QWFqUG9maFBJUEdSUmtXOTVTSnMiLCJhbGciOiJSUzI1NiIsIng1dCI6ImtXYmthYTZxczh3c1RuQndpaU5ZT2hIYm5BdyIsImtpZCI6ImtXYmthYTZxczh3c1RuQndpaU5ZT2hIYm5BdyJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTAwMDAtYzAwMC0wMDAwMDAwMDAwMDAiLCJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC8zYTc0YmRlZi05ZWQ1LTQ0NGMtYjZjNC1kYmFhYmMwNmMwNGYvIiwiaWF0IjoxNzA4MTc5NDA1LCJuYmYiOjE3MDgxNzk0MDUsImV4cCI6MTcwODE4NDkwNCwiYWNjdCI6MCwiYWNyIjoiMSIsImFjcnMiOlsidXJuOnVzZXI6cmVnaXN0ZXJzZWN1cml0eWluZm8iXSwiYWlvIjoiQVRRQXkvOFZBQUFBVm53ZDkvM0tZK3VNU2I4eWlHTVlyZXd2c2xCY2diNEI3NFkxVkV3d290ZTM5Wnd4ZUhMaVB2aUVVcDNodnBnRSIsImFtciI6WyJwd2QiXSwiYXBwX2Rpc3BsYXluYW1lIjoiT3V0bG9vayBBZGRpbiIsImFwcGlkIjoiMTc1Zjc2ZDAtY2YxNS00MjBlLTg2NmUtYjBjOWZjNmJmODFiIiwiYXBwaWRhY3IiOiIwIiwiaGFzd2lkcyI6InRydWUiLCJpZHR5cCI6InVzZXIiLCJpcGFkZHIiOiI3NC4yMzQuNTAuMzMiLCJuYW1lIjoiZnVuZGF0aW8iLCJvaWQiOiJiMjU2NDRhYy0xNjAyLTQ2NzUtOTMwZC0xNDJmZDhkYzc3MzAiLCJwbGF0ZiI6IjMiLCJwdWlkIjoiMTAwMzIwMDE2NzI4QjIzQSIsInJoIjoiMC5BWUVBNzcxME90V2VURVMyeE51cXZBYkFUd01BQUFBQUFBQUF3QUFBQUFBQUFBQ0JBT0EuIiwic2NwIjoiZW1haWwgRmlsZXMuUmVhZCBGaWxlcy5SZWFkLkFsbCBGaWxlcy5SZWFkV3JpdGUgRmlsZXMuUmVhZFdyaXRlLkFsbCBNYWlsLlJlYWQgTWFpbC5SZWFkQmFzaWMgTWFpbC5SZWFkV3JpdGUgTWFpbC5TZW5kIG9wZW5pZCBwcm9maWxlIFVzZXIuUmVhZCIsInN1YiI6IkFVU0wzSl9OQ0g0OTZEcDg0cUtydUE3Ym93Vkw0YjZqYUFnYUNNbGh6d0kiLCJ0ZW5hbnRfcmVnaW9uX3Njb3BlIjoiRVUiLCJ0aWQiOiIzYTc0YmRlZi05ZWQ1LTQ0NGMtYjZjNC1kYmFhYmMwNmMwNGYiLCJ1bmlxdWVfbmFtZSI6ImZ1bmRhdGlvQGZ1bmRhdGlvLm9yZyIsInVwbiI6ImZ1bmRhdGlvQGZ1bmRhdGlvLm9yZyIsInV0aSI6Imd1YjRCNERVNTBhY1BOeXVsRk1HQVEiLCJ2ZXIiOiIxLjAiLCJ4bXNfc3QiOnsic3ViIjoiVFRJcVNfanhaNXAyRnpROVJPaG5tZWxLVjNrRkFPdmQ5Z2lEUUZySU15QSJ9LCJ4bXNfdGNkdCI6MTYxODQ4MjgyNCwieG1zX3RkYnIiOiJFVSJ9.LS0n3DWrv-YHufr9oA4PW97_nwQ_oP6Z4e-jdWvQrU97nznZQs9w-qfeRvtijUXvmVEGo8fyUgCCZ1UNLB3pbOIWZYIOPhXmsGiWs5sjdn9-vKT-394jBUqCqkaLXa2aldBWGUmklDJ81TYzFV4C7BEjQang162KjHqetXg118OEmDZaayd1VyNWIc2xQ6RK-gmxvPOqv8CPIAOj4fQ8HcQxpUtpSONr98mVwX4potYpJVV2Vn6-gaLF86DYNrxw1rBt3qOMhCInHMwxgQHsLK_XO2tnSoJ-LZzk5NusOOpnM4GVrcsKgA9jUK3NwBrJYpda2RAkcHfcM5hkOYxc1A

疑问

普通微软账户的token可正常发送邮件，但Office 365租户账户的token调用邮件接口时返回401错误，请问这两种token有何差异？如何实现两种账户都能正常发送邮件？

解答

两种token的核心差异

令牌格式与标准不同
- 普通微软账户的token是旧版ADAL令牌（以EwCo开头），属于针对个人Microsoft账户的传统非JWT格式令牌，适配旧版Exchange服务或Graph API的兼容模式。
- Office 365租户账户的token是标准JWT格式令牌（以eyJ开头），由Azure AD v2.0端点返回，遵循OAuth 2.0/OpenID Connect规范，仅适配现代API（如Microsoft Graph）。
权限与受众匹配问题
从租户token的aud（受众）字段可以看到值为00000003-0000-0000-c000-000000000000，这是Microsoft Graph的全局受众ID，但需确认：
- 你调用的邮件接口是否为Microsoft Graph端点（而非旧版EWS）；
- token的scp字段是否包含mail.send权限；
- 租户是否配置了条件访问策略，限制该令牌在Office插件环境中的使用。
令牌提取逻辑存在缺陷
当前通过split("=")和split("&")提取令牌的方式，在JWT场景下存在风险：JWT本身包含.分隔符，若URL片段中参数顺序变化，可能误提取到id_token或截断令牌，导致无效凭证。

解决方法

修复令牌提取逻辑
使用URLSearchParams解析URL片段参数，确保准确获取access_token：

var address_Link = window.location.href;
var fragment = address_Link.split('#')[1];
var params = new URLSearchParams(fragment);
var access_token = params.get('access_token');
console.log(access_token);
Office.onReady(function (appInfo) {    
  Office.context.ui.messageParent(JSON.stringify(access_token));
});

统一使用Microsoft Graph端点
租户账户的JWT令牌仅适用于Microsoft Graph API，调用邮件发送接口时必须使用：
```
POST https://graph.microsoft.com/v1.0/me/sendMail
```
不能使用旧版EWS端点，否则会返回401错误。
验证令牌权限与租户配置
- 用JWT解析工具查看租户token的scp字段，确认包含mail.send权限；
- 联系租户管理员，确认未配置阻止插件应用使用令牌的条件访问策略；
- 若应用为租户内注册，确保mail.send权限已获得管理员或用户的同意。
标准化登录流程
持续使用Azure AD v2.0端点进行登录，该端点支持个人Microsoft账户和租户账户，返回的JWT令牌格式统一，便于后续权限验证和接口调用。

内容的提问来源于stack exchange，提问作者M Junaid

Office 365租户Access Token调用邮件接口401问题排查

疑问 #

两种token的核心差异 #

解决方法 #

疑问

两种token的核心差异

解决方法