Graph API calls to OnPremise Exchange only works in Playground

user_6330050 0
Viewed 1849

Our setup is an on-premise Exchange Server which is accessible over the graph api. https://docs.microsoft.com/en-us/graph/hybrid-rest-support

(https://www.msxfaq.de/cloud/graph/graph_und_exchange_onprem.htm)

We run in the issue, that our token is only "partial" working. And a token created by "Graph-Playground" is fully working. But we can't find any difference.

  • When I use Graph-Playground or use the token generated by Graph-Playground => all requests are working
  • When I create a token (over my app registration) => only some requests are working

The token seems to be valid some calls like /me are working, but all calls related to exchange like /me/contacts are failing with this error

Request, they work with token generated by Postman:**
Error:
{ "error": { "code": "MailboxNotEnabledForRESTAPI", "message": "REST API is not yet supported for this mailbox." } }

(that's a very generic error, and mostly don't say anything about the real issue)

Token Generation:

I create my token on the same way as Graph-Playground create the token (OAuth - Implicit flow):

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=token&state=test2&client_id=????&scope=openid%20profile%20User.Read%20email%20Contacts.Read&redirect_uri=????

Token - Analysis:

enter image description here

As a side note, it was working for a few days, nobody changed anything :)

So I have no idea, why the "Graph Playground" can create a working token, and my token only "partially" works. Can you help me?

There is already a thread, but I'm not the owner of it. Also there are no more responses... I can't provide a bounty for a foreign thread, that's why I create a new thread. You can find it here:

MailboxNotEnabledForRESTAPI - Microsoft Graph API integration with HMA Enabled on-premise server

on-premises-instances hybrid microsoft-graph-api exchange-server
1 Answers

I recognize your error, we see it in several cases (for Office 365):

  1. User has no Exchange license (probably not the case, since it works in the explorer).
  2. Customer tenant has setup additional security.

You can limit applications to certain mailboxes. Maybe there is some kind of setting or policy like this on your local Exchange as well, you have to connect to Exchange Online Powershell to set it, so maybe you can find something there. This is just a wild guess.

To track down this issue I would start checking the local Exchange logs.

Have you tried using the /users/{upn}/calendar endpoint? Maybe it's just that the /me/ part doesn't work.

user_6391530
Related