Azure Graph API-检查用户是否具有对O365邮箱的完全访问权限

Question

I am using the ActiveDirectory GraphClient library by Microsoft to access an Azure AD.

My problem is:

I'd like to get to known if an IUser object has full access to an Office 365 mailbox of another user.

void bool HasFullAccess(IActiveDirectoryClient client, IUser currentUser, IUser otherUser)
{
    if (currentUser.ObjectId == otherUser.ObjectId)
    {
        return true;
    }

    //TODO: HOW-TO CHECK IF 'currentUser' HAS FULL ACCESS
    //      TO MAILBOX OF 'otherUser'
}

Answer 1

Really good question, you want to be looking at both the full_access_as_user and full_access_as_app depending on your scenario. Once you have the access token for the user you should be looking at some of the API calls that are documented in the Outlook REST API .

Answer 2

There are two possible ways to check whether a user could access another user's mailbox :

1. EWS Managed API

   If you have permission to access another user's mailbox ,you could get the data via :

     ExchangeService service = new ExchangeService(ExchangeVersion.Exchange2007_SP1); service.Credentials = new WebCredentials("user_with_access@example.com", "PASSWORD"); service.TraceEnabled = true; service.TraceFlags = TraceFlags.All; service.AutodiscoverUrl("user_with_access@example.com", RedirectionUrlValidationCallback); var userMailbox = new Mailbox("target_user@example.com"); var folderId = new FolderId(WellKnownFolderName.Inbox, userMailbox); var itemView = new ItemView(20); // page size var userItems = service.FindItems(folderId, itemView); foreach (var item in userItems) { // do something with item (nb: it might not be a message) } 

   Above code need user's credential .If you don't have permission to access target user's mailbox ,above code will threw an error like " The process failed to get the correct properties" .

2. PowerShell

   By running Get-MailboxPermission cmdlet you can check which user/mailbox has what type of permissions to access other mailboxes in Exchange:

    Get-Mailbox <Mailbox> | Get-MailboxPermission -User <AD User> 

   You could call powershell to check it in your application .