Outlook App using Azure App Connection is Broken

Questions
,
1

For those of you that want send email using an Azure App connection, rather than an individual user account, please know that the built-in Outlook app will not work for that purpose.

  1. When You Use User Credentials (Delegated Permissions)

  • You authenticate as a user (via OAuth authorization code, device code, etc.).

  • The access token contains the user’s identity (UPN).

  • In this case, you can use the endpoint:

POST https://graph.microsoft.com/v1.0/me/sendMail

  • Why it works:

    • me is a shortcut for “the currently logged-in user,” and since the token represents that user, Graph knows who me is.

2. When You Use App Credentials (Application Permissions)

  • You authenticate as an app (via client credentials flow).

  • The access token has no user identity — it only represents the application.

  • Since there is no “current user” in the token, Graph cannot resolve /me.

  • That’s why /me/sendMail fails when using app credentials.

Instead, you must specify the mailbox explicitly:

POST https://graph.microsoft.com/v1.0/users/{user-id | userPrincipalName}/sendMail

Example:

POST https://graph.microsoft.com/v1.0/users/mailaccount@abcinc.com/sendMail

  • This tells Graph exactly which mailbox to send from.

  • The app must have Mail.Send application permission granted and admin consent applied.

  • Optionally, the target mailbox must allow the app to send as that user (depending on your security model).

To be transparent, I don’t know if this effects the other apps, but I’m going to look, as I suspect that this might have been used in the build of all of the Microsoft Apps. This really should be changed so that the app will work across both.

3

OK, I have an update on this topic. . .

1.) All of the built-in Microsoft Apps are defective. While they don’t all of the endpoint problem that the Outlook App has, they ALL use default connection scopes which are invalid for authorization against an Azure App. You can’t remove the scopes, only add to them.

2.) You also can’t use the default HTTPS Oath 2.0 request for authorization against Microsoft Graph API either, because when you are authenticating against an Azure App, there is no Authorize URI. Since no user is involved, it’s a Client Credentials Flow that goes directly to the token URI. The default HTTPS Oath 2.0 request insists on a Authorize URI.

This means you have to use a standard HTTPS node for both the authorization and the Graph API call. This means the credentials are stored in the Scenario nodes for anyone to see. This is NOT an acceptable option.

Make.com, please get these apps updated for proper use with Azure App connections.

1 Like