使用C# Exchange Service无法访问Office 365共享邮箱求助

问题描述 #

尝试读取Microsoft 365管理的共享邮箱时，触发以下错误：
Microsoft.Exchange.WebServices.Data.ServiceRequestException: 'The request failed. The remote server returned an error: (403) Forbidden.'

相关代码 #

初始实现代码：

IConfidentialClientApplication cca = ConfidentialClientApplicationBuilder
    .Create(ConfigurationManager.AppSettings["appId"])
    .WithClientSecret(ConfigurationManager.AppSettings["clientSecret"])
    .WithTenantId(ConfigurationManager.AppSettings["tenantId"])
    .Build();

string[] ewsScopes = new string[] {
    "https://outlook.office365.com/.default"
};

AuthenticationResult authResult = await cca.AcquireTokenForClient(ewsScopes).ExecuteAsync();
string accessToken = authResult.AccessToken;

if (accessToken != null)
{
    var ewsClient = new ExchangeService();
    ewsClient.Url = new Uri("https://outlook.office365.com/EWS/Exchange.asmx");
    ewsClient.Credentials = new OAuthCredentials(accessToken);
    ewsClient.ImpersonatedUserId = new ImpersonatedUserId(ConnectingIdType.PrincipalName, "production@rvcapital.com");

    ewsClient.HttpHeaders.Add("X-AnchorMailbox", "production@abcd.com");

    var folders = ewsClient.FindFolders(WellKnownFolderName.Inbox, new FolderView(10));
}

尝试过的调整代码：

FolderId SharedMailbox = new FolderId(WellKnownFolderName.Inbox,"Shared@domain.com"); 
ItemView itemView = new ItemView(1000); 
service.FindItems(SharedMailbox,itemView);

解决步骤 #

• 修正应用权限配置
  客户端凭证模式（AcquireTokenForClient）要求应用注册使用应用权限，而非委派权限。必须在Azure AD中给应用添加Exchange.ManageAsApp权限，且需要全局管理员完成权限同意操作。FullAccess等委派权限不适用于此模式。

• 调整邮箱访问逻辑
  代码中同时设置ImpersonatedUserId和X-AnchorMailbox会导致权限冲突。访问共享邮箱无需模拟用户，直接指定目标共享邮箱的FolderId即可。修改后的核心代码如下：

  // 移除模拟用户和X-AnchorMailbox的配置
  // ewsClient.ImpersonatedUserId = new ImpersonatedUserId(...);
  // ewsClient.HttpHeaders.Add("X-AnchorMailbox", ...);
  
  // 直接访问共享邮箱的收件箱
  FolderId sharedMailboxInbox = new FolderId(WellKnownFolderName.Inbox, "Shared@domain.com");
  var folders = ewsClient.FindFolders(sharedMailboxInbox, new FolderView(10));
  

• 验证权限同步状态
  权限同意后，需等待15-30分钟让Azure AD完成权限同步。可通过PowerShell命令确认应用已获取目标权限：

  # 获取应用的ObjectId
  $app = Get-AzureADServicePrincipal -SearchString "你的应用名称"
  # 查看应用已分配的权限
  Get-AzureADServiceAppRoleAssignment -ObjectId $app.ObjectId
  

  确保结果中包含Exchange.ManageAsApp权限条目。

• 检查共享邮箱权限限制
  确认共享邮箱未设置特殊权限拦截。虽然客户端凭证模式下Exchange.ManageAsApp权限已足够，但可在Exchange管理中心检查共享邮箱的权限配置，排除额外限制。

• 指定正确的EWS版本
  初始化ExchangeService时明确指定兼容的Exchange版本，避免因版本不兼容导致的权限验证失败：

  var ewsClient = new ExchangeService(ExchangeVersion.Exchange2016);
  

内容的提问来源于stack exchange，提问作者Shishank Jain