WHD 12.8.4 Is out, start your testing!

Testing has gone fairly well on our test platform...EXCEPT for OAuth for outgoing M365 email. I was under the impression that this was fixed for x.8.4, but apparently not.

Submitted a ticket yesterday. Support got back to me asking if we had created a new client secret. We didn't, but didn't know that could be an issue. The incoming mail, which uses the same account, using OAuth, is working fine. Waiting on their follow-up to that information. 

Outgoing mail is working in Test! But....incoming mail, which worked before switching APIs, now doesn't. Did a re-auth using the new secret, which authenticated fine, but saving the account then resulted error. Deleting the incoming account and re-adding. Of course, I forgot to delete email history, so it'll take a while. Also why I can't copy/paste the error right now. Enabled debugging, so will grab all that later.

Bet you wished you had gone with two Registered Apps in EntraID, one for Inbound and the other for Outbound!?

Ah! Is that the problem?

Error code: ErrorAccessDenied Error message: Access is denied. Check credentials and try again. GET graph.microsoft.com/.../mailFolders SdkVersion : graph-java/v5.60.0 403 : [...] [Some information was truncated for brevity, enable debug logging for more details]

GET graph.microsoft.com/.../mailFolders
SdkVersion : graph-java/v5.60.0

401 :
[...]

[Some information was truncated for brevity, enable debug logging for more details]
at com.microsoft.graph.http.GraphServiceException.createFromResponse(GraphServiceException.java:419)
at com.microsoft.graph.http.GraphServiceException.createFromResponse(GraphServiceException.java:378)
at com.microsoft.graph.http.CoreHttpProvider.handleErrorResponse(CoreHttpProvider.java:510)
at com.microsoft.graph.http.CoreHttpProvider.processResponse(CoreHttpProvider.java:442)
at com.microsoft.graph.http.CoreHttpProvider.sendRequestInternal(CoreHttpProvider.java:408)
at com.microsoft.graph.http.CoreHttpProvider.send(CoreHttpProvider.java:225)
at com.microsoft.graph.http.CoreHttpProvider.send(CoreHttpProvider.java:202)
at com.microsoft.graph.http.BaseCollectionRequest.send(BaseCollectionRequest.java:103)
at com.microsoft.graph.http.BaseEntityCollectionRequest.get(BaseEntityCollectionRequest.java:78)
at com.macsdesign.whd.util.exchange.impl.GraphAccountReaderImpl.getMessages(GraphAccountReaderImpl.java:30)
at com.macsdesign.whd.daemon.WHDEmailTicketDaemon$WHDEmailAccountReader.checkInbox(WHDEmailTicketDaemon.java:711)
at com.macsdesign.whd.daemon.WHDEmailTicketDaemon.retrieveNewTickets(WHDEmailTicketDaemon.java:311)
at com.macsdesign.whd.daemon.WHDEmailTicketDaemon.startDaemonTask(WHDEmailTicketDaemon.java:207)
at com.macsdesign.whd.daemon.DaemonTask$1.executeWithEditingContext(DaemonTask.java:99)
at com.macsdesign.util.TemporaryEditingContext.executeWithDedicatedOSC(TemporaryEditingContext.java:50)
at com.macsdesign.whd.daemon.DaemonTask.runWithSeparateOSC(DaemonTask.java:94)
at com.macsdesign.whd.daemon.DaemonTask.run(DaemonTask.java:48)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
at java.base/java.util.concurrent.FutureTask.runAndReset(FutureTask.java:305)
at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:305)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at java.base/java.lang.Thread.run(Thread.java:829)
2025-01-22 10:48:25.420 [MailTicketDaemonExecutor-thread-1] INFO c.s.common.oauth.OauthClientService - Do token request for type class com.solarwinds.common.oauth.azure.AzureOauthTokenResponse
2025-01-22 10:48:25.844 [MailTicketDaemonExecutor-thread-1] ERROR whd.daemon.daemons.emailticket - Error while attempting to process new email tickets from whdtest@bellevue.edu (host 'null'): com.microsoft.graph.http.GraphServiceException: Error code: InvalidAuthenticationToken
Error message: Access token validation failure. Invalid audience.

Are you able to PM me the current settings for the permissions on the API within EntraID of the Registered App?

I wondered why I hadn't gotten responses to the other PMs I sent you:

You cannot currently message this user, either you do not have permission or the user is not accepting messages.

I don't know if we have to be "Connected", I have sent a connection request again.

This has finally been resolved! Through a support call and remote session, we finally figured out that the documentation is basically wrong, or at the least, misleading. The permission for mail access needs to be DELEGATE, not Application, as is hinted by the documentation. Very frustrating. But the tech, Davie, is going to escalate the documentation issue.

Forgot something...we were able to do this with only a single Azure API application for both inbound and outbound.

Here is the correct Graph API Permissions for using a single Azure application for both Inbound and Outbound (OAuth):

Here is the correct Graph API Permissions for using a single Azure application for both Inbound and Outbound (OAuth):