MS Graph API 在一次呼叫中阻止凭据，但在另一次呼叫中不阻止

Question

While expanding our WPF Apps emailing functions to include larger attachments, we went from using the MS GRAPH API endpoint me/sendMail to send emails:

https://graph.microsoft.com/v1.0/me/sendMail

to using the me/messages endpoint to create a draft so that we could create an upload session to that draft so that we could upload larger attachments (pdf reports)

https://graph.microsoft.com/v1.0/me/messages

We are acquiring tokens via MSAL for both. However, when using the second method, we receive the following response:

"ErrorAccessDenied"
"Access is denied. Check credentials and try again."

Our expectation was that those two endpoints wouldn't have different credentialing requirements. Our organization's AzureAD accounts are federated delegate, so the only flow we can use is interactive Authorization Code -- so we are calling into MSAL to get the AzureAD token for both endpoints.

Answer 1

The endpoint for creating a draft message

POST /me/messages

requires Mail.ReadWrite permission. While endpoints for sending mail

POST /me/messages/{id}/send
POST /me/sendMail

require Mail.Send .

Adding Mail.ReadWrite permission should resolve the error.