使用EWS与OAuth发送邮件时遭遇403禁止错误求助

针对你遇到的403禁止错误，核心问题集中在OAuth权限配置、邮箱授权和代码细节三个方面，以下是具体排查和修复方案：

1. 修正Azure AD应用权限配置 #

你当前配置的是委派（Delegated）权限（EWS.AccessAsUser.All），但客户端凭证流（AcquireTokenForClient）需要的是应用（Application）权限：

• 登录Azure AD，找到你的应用，进入「API权限」页面
• 删除现有的委派权限，添加Exchange > 应用权限 > EWS.AccessAsApp
• 点击「授予管理员同意」（必须完成此步骤，否则权限不会生效）

2. 配置邮箱应用访问权限 #

即使添加了应用权限，还需通过PowerShell给目标邮箱（即代码中from对应的NoReply@myCompany.com）配置允许应用模拟访问的权限：

New-ApplicationAccessPolicy -AppId "你的应用ID" -PolicyScopeGroupId "NoReply@myCompany.com" -AccessRight Allow -Description "允许应用访问该邮箱"

3. 优化代码异步逻辑 #

避免用.Result同步等待异步方法，改成异步调用防止死锁，调整代码如下：

public static async Task SendMail(string to, string cc, string bcc, string replyTo, string from, string subject, bool isHtmlFormat, string body, string[] attachments)
{
    var cca = ConfidentialClientApplicationBuilder.Create("my-app-id")
                                                  .WithClientSecret("my-client-secret")
                                                  .WithTenantId("my-tenant-id")
                                                  .Build();

    var authResult = await cca.AcquireTokenForClient(new string[] { "https://outlook.office365.com/.default" }).ExecuteAsync();

    string[] recipients = to.Replace(" ", "").Split(';');
    string[] repliesTo  = string.IsNullOrWhiteSpace(replyTo) ? Array.Empty<string>() : replyTo.Replace(" ", "").Split(';');
    string[] ccs        = string.IsNullOrWhiteSpace(cc)      ? Array.Empty<string>() : cc.Replace(" ", "").Split(';');
    string[] bccs       = string.IsNullOrWhiteSpace(bcc)     ? Array.Empty<string>() : bcc.Replace(" ", "").Split(';');

    ExchangeService service = new ExchangeService
    {
        Url                = new Uri("https://outlook.office365.com/EWS/Exchange.asmx"),
        Credentials        = new OAuthCredentials(authResult.AccessToken),
        ImpersonatedUserId = new ImpersonatedUserId(ConnectingIdType.SmtpAddress, from)
    };

    service.HttpHeaders.Add("X-AnchorMailbox", from);

    EmailMessage emailMessage = new EmailMessage(service)
    {
        From = new EmailAddress(from),
        Subject = subject, 
        Body = new MessageBody(isHtmlFormat ? BodyType.HTML : BodyType.Text, body)
    };

    emailMessage.ToRecipients.AddRange(recipients);
    emailMessage.ReplyTo.AddRange(repliesTo);
    emailMessage.CcRecipients.AddRange(ccs);
    emailMessage.BccRecipients.AddRange(bccs);

    foreach (string attachment in attachments ?? Array.Empty<string>())
    {
        emailMessage.Attachments.AddFileAttachment(attachment);
    }

    await emailMessage.SendAsync();
}

调用时使用异步方式：

await MailHelper.SendMail("MyEmail@myCompany.com", null, null, null, "NoReply@myCompany.com", "Test subject", false, "This is a test body", null);

4. 额外检查点 #

• 确认目标邮箱未禁用EWS访问：通过PowerShell执行Get-CASMailbox "NoReply@myCompany.com" | Select-Object EwsEnabled，若结果为False，执行Set-CASMailbox "NoReply@myCompany.com" -EwsEnabled $True开启
• 确认应用为租户内应用，若为多租户需确保目标租户已完成管理员权限同意

内容的提问来源于stack exchange，提问作者MastErAldo