Graph Explorer newbie question: Forbidden - 403 when GETTING other user's email using a logged on UPN of an Exchange Admin

Question

I have a question to ask about using Graph Explorer.

I logged onto Graph Explorer using my admin account which has the role of Exchange Administrator.

However, when I execute a query just to get another user's high importance email, it came back with forbidden. The query is just a simple https://graph.microsoft.com/v1.0/users/[email protected]/messages?$filter=importance eq 'high'

I have already consented the permissions as you can see from the image below.

Can anyone be kind enough to point me in the right direction?

(Graph Explorer screen capture)

Thanks.

Answer 1

I guess that permission tab show the incorrect information. To access mail of another user you will need at least Mail.Read.Shared and Mail.ReadWrite.Shared permissions.

Probably due to security reason you will also need other permissions like User.Read.All

• Mail.Read.Shared

Allows the app to read mail that the user can access, including the user's own and shared mail.

• Mail.ReadWrite.Shared

Allows the app to create, read, update, and delete mail that the user has permission to access, including the user's own and shared mail. Does not include permission to send mail.

Resource:

Mail permissions