Microsoft Graph API Mail.Send 訪問被拒絕

Question

我已在 Azure Active Directory 中將一個應用程序注冊為使用客戶端機密進行身份驗證的守護程序。 我添加了 Graph API 權限並已授予管理員許可以獲取共享點列表，並且可以在 c# 中使用 Graph API 成功拉取。 我還向 Mail.Send Graph API 授予了管理員同意，但訪問被拒絕。 呼叫設置正確，我用作發件人字段的電子郵件地址是管理員郵箱。 我正在做一些額外的配置或錯過配置嗎？

打電話認證

var clientSecret = @"{My generated Secret in Azure}"; var clientId = @"{My Client Id}"; var tenantID = @"{My Tenant Id}"; IConfidentialClientApplication confidentialClientApplication = ConfidentialClientApplicationBuilder .Create(clientId) .WithTenantId(tenantID) .WithClientSecret(clientSecret) .Build(); ClientCredentialProvider authenticationProvider = new ClientCredentialProvider(confidentialClientApplication); return new GraphServiceClient(authenticationProvider);

我的呼叫代碼發送電子郵件

System.IO.MemoryStream ms = new System.IO.MemoryStream(); System.IO.StreamWriter writer = new System.IO.StreamWriter(ms); writer.Write(htmlDocument.Text); writer.Flush(); writer.Dispose(); MessageAttachmentsCollectionPage attachments = new MessageAttachmentsCollectionPage(); attachments.Add(new FileAttachment { ODataType = "#microsoft.graph.fileAttachment", ContentBytes = ms.ToArray(), ContentType = "text/html", ContentId = "testing", Name = "My_Report.html" }); var message = new Message { Subject = "My Report", Body = new ItemBody { ContentType = BodyType.Text, Content = "Here is your updated report from list" }, ToRecipients = new List<Recipient>() { new Recipient { EmailAddress = new EmailAddress { Address = "{End User to receive report}" } } }, CcRecipients = new List<Recipient>() { new Recipient { EmailAddress = new EmailAddress { Address = "{my admin email account}" } } }, From = new Recipient { EmailAddress = new EmailAddress { Address = "{my admin email account}" } }, Attachments = attachments }; var graphServiceClient = GetGraphServiceClient(); await graphServiceClient.Me .SendMail(message, null) .Request() .PostAsync();

Answer 1

您正在使用客戶端憑據流。

當作為應用程序（而不是與用戶）進行身份驗證時，您不能使用委托權限 - 由用戶授予的范圍。 您必須使用應用程序權限（也稱為角色），這些權限由應用程序管理員授予或通過 Web API 的預授權授予。

因此，您應該在門戶中授予應用程序權限並授予管理員同意。

並修改如下代碼。

  await graphClient.Users["your admin email account"]
                .SendMail(message, null)
                .Request()
                .PostAsync();