使用Microsoft Graph获取其他Office 365用户邮件文件夹时权限被拒绝

Hey there, let's break down why you're hitting that "Access is denied" error when trying to pull another user's mail folders, and walk through how to fix it. Since you're an Azure AD and Office 365 admin, the issue almost always comes down to missing permissions or incorrect consent settings. Here's what to check step by step:

1. Verify Your App Registration's Permissions #

First, head to your Azure AD app registration and make sure you've added the right Microsoft Graph permissions for accessing other users' mail:

• If you're using delegated permissions (since you're authenticating with your own user credentials):
  • Add Mail.Read.Shared or Mail.ReadWrite.Shared — these let you access other users' mail as an admin (not just mail shared directly with you).
• If you plan to use application permissions (for app-only access without a user context):
  • Add Mail.Read or Mail.ReadWrite — application permissions grant the app broad access to all users' mail folders, perfect for admin automation tasks.

2. Ensure Admin Consent is Granted #

Delegated permissions like Mail.Read.Shared require admin-level consent to work across all users—user-level consent won't cut it here. In your app registration:

• Go to the "API permissions" tab.
• Click the "Grant admin consent for [your tenant name]" button and confirm.
• This ensures your admin account has the necessary rights to access other users' mail data via Graph.

3. Confirm Your Admin Role Includes Exchange Access #

Being an Azure AD admin doesn't automatically give you permissions to manage Exchange data. Make sure your account has one of these roles assigned:

• Global Administrator
• Exchange Administrator
• Mailbox Administrator

These roles explicitly grant the ability to access and manage other users' mailboxes through Microsoft Graph.

4. Validate Your Access Token's Permissions #

Grab your access token and decode it using a tool like jwt.ms (you can do this locally, no external site required). Check the relevant claims:

• For delegated permissions: Look for the scp claim—it should include Mail.Read.Shared or Mail.ReadWrite.Shared.
• For application permissions: Look for the roles claim—it should include Mail.Read or Mail.ReadWrite.

If the required permissions aren't present, you'll need to re-authenticate with the correct scope in your token request.

5. Double-Check Your Code's Permission Scope #

When requesting the access token, make sure your scope includes the necessary permission. For example, with delegated auth, your scope string should look like this:

var scopes = new[] { "https://graph.microsoft.com/Mail.Read.Shared" };

If you need multiple scopes, separate them with spaces:

var scopes = new[] { "https://graph.microsoft.com/Mail.Read", "https://graph.microsoft.com/Mail.Read.Shared" };

Quick Test to Confirm #

After updating permissions and granting consent, re-authenticate to get a fresh token, then try your original call again:

var mailFoldersPage = await graphClient.Users[otherUserId].MailFolders.Request().GetAsync();

If you still run into issues, double-check that the target user's mailbox isn't disabled or restricted, and that your tenant doesn't have conditional access policies blocking the request.

内容的提问来源于stack exchange，提问作者Nin Hassanin