Announcing OAuth 2.0 Client Credentials Flow support for POP and IMAP protocols in Exchange Online

FYI, I received confirmation from MS Support case that we can indeed safely assume that only the mailboxes which have granted FullAccess/Send-As will be accessible to these application permission versions of IMAP.AccessAsApp, POP.AccessAsApp, and SMTP.AccessAsApp.

Thanks ViliusS and yes indeed in this case I'm focused on the EXO API and not MS Graph.  It's for an application ("SAP Build Process Automation").  Good to know the answer is what I wanted.  Would be nice to have these things all tightened up as far as how and where they're described and/or documented.

JeremyTBradshaw it depends on what protocol you are using to send.

If you are using Exchange Online API, then SMTP protocol is used "underneath". SMTP protocol requires a user. So even for application running with client credential flow you must specify a user, which is basically impersonated by the application. Hence, you must set which mailboxes service principal can impersonate. Granting SMTP.SendAsApp is not enough. The documentation could be clearer, but so far it says "Allows the app to have send access to all mailboxes". It doesn't say "Allows the app to send as any mailbox" 🙂

Alternatively, if you are using MS Graph API, then you either:

a) set Mail.Send permission on API level and allow access to all mailboxes, or

b) don't set any API level permissions at all, but configure RBAC with "Application Mail.Send" role and set the role to apply to needed mailboxes. 

The_Exchange_Team and anyone else savvy on this topic... I'm wondering about scoping of access to specific mailboxes for "Office 365 Exchange Online" > "Application Permissions" > "SMTP" > "SMTP.SendAsApp".

In the Entra UI, we're told this permission allows the app to have send access to all mailboxes.  That seems inline with typical Application Permissions.

But then the documentation states that we need to create the EXO-side service principal to match-up with the Entra ID service principal, and then grant the EXO-side SPN FullAccess/Send-As to grant the necessary access.

This seems to be outside the lanes of RBAC for Applications in Exchange Online, as well as Application Access Policies.  The question is - can we truly, safely assume that only the mailboxes which have granted FullAccess/Send-As will be accessible to these application permission versions of IMAP.AccessAsApp, POP.AccessAsApp, and SMTP.AccessAsApp?

Thanks in advance.

Alex1201 

Make sure you use TLS 1.2

Protocol error. Connection is closed. 10

anyone know this wrong? thanks

Thank you.. That was a big help

Hi Kinjal1012

I've included a snippet of my code that is working successfully.  When using OAuth, you shouldn't be adding an Authenticator to the Session variable (instead leave it as null) since you have already obtained the access (bearer) token.  That  token should be added as a value to the "mail.smtp.sasl.mechanisms.oauth2.oauthToken" property as shown below.   Also include that token as a parameter in the connect method of the transport.

// Create a mail session        

Properties props = new Properties();         
props.put("mail.smtp.connectiontimeout", "10000");        
props.put("mail.smtp.timeout", "10000");        
props.put("mail.smtp.sendpartial", "true");        
props.put("mail.smtp.starttls.enable", "true");  
props.put("mail.smtp.ssl.trust", "*"); 

props.put("mail.smtp.host", smtpHost); 
props.put("mail.smtp.port", "" + smtpPort);       
props.put("mail.smtp.auth", "true"); 

// Get the bearer token for OAUTH2 Access to the MS Exchange/365 server              
OAuthToken oauth = new OAuthToken();               
String authToken = oauth.getAuthToken();                      

props.put("mail.smtp.auth.mechanisms", "XOAUTH2");
props.put("mail.smtp.sasl.mechanisms.oauth2.oauthToken", authToken);
props.put("mail.smtp.auth.login.disable", "true");               
props.put("mail.smtp.auth.plain.disable", "true");               
props.put("mail.smtp.auth.xoauth2.disable", "false");                
             
if (debug) {
  props.put("mail.debug.auth", "true");               
  props.put("mail.debug.auth.password", "true");        
}

Session session = Session.getInstance(props, null);              
session.setDebug(debug);

// Construct the message       
Message msg = new MimeMessage(session);       
msg.setFrom(new InternetAddress(fromAddr));       
msg.setSubject(subject);
msg.setText(content);
msg.saveChanges();

try {
  transport = session.getTransport("smtp");      
  transport.connect(user, authToken);      
  transport.sendMessage(msg, msg.getAllRecipients());
} finally {
  transport.close(); 
} 

Hope this helps!

Just to let everyone know, after I was able to obtain the OAUTH bearer token, I then faced an Authentication Failed error while trying to use that token to send SMTP emails using client credentials flow.

It turns out that my Azure server had not been fully configured with all the permissions needed to send the emails.  

The last steps described here-> https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth#register-service-principals-in-exchange to create the service principal and give it permissions to the target mailbox had not been done. 

Once this was completed, I was able to send SMTP emails  through javamail successfully.