Notes from the field: Using OAuth for ActiveSync and POP/IMAP in Exchange Online

Thanks  Danijel_Klaric that helped to get a step further. 

It was set up to use "Web", not Mobile and Desktop, i changed it at "AzureAd" - "App Registrations" - "Name of the app" - "Authentication".

I used the default redirect URL https://login.microsoftonline.com/common/oauth2/nativeclient and set "Allow public client flows" to "No".

Now, 2 of the 3 methods do work 

Those work fine, thank you for that:

.\Get-IMAPAccessToken.ps1 -tenantID "0xxx0" -clientId "7xxx4" -clientsecret 'Fxxxl' -targetMailbox "SharedMailbox_AT_xxx.com"

.\Get-IMAPAccessToken.ps1 -tenantID "0xxx0" -clientId "7xxx4" -redirectUri "https://login.microsoftonline.com/common/oauth2/nativeclient" -LoginHint "SharedMailbox_AT_xxx.com"

Yet i still get an error when trying to verify access to the SharedMailbox with another Account, which has full access.

FullAccess is set up on the SharedMailbox for the ServicePrincipal and the other mailbox:

Get-Mailboxpermission -Identity SharedMailbox_AT_xxx.com

Identity                 User              AccessRights            
--------                 ----              ------------            
SharedMailbox_AT_xxx.com NT AUTHORITY\SELF {FullAccess, ReadPermission} 
SharedMailbox_AT_xxx.com NT AUTHORITY\SELF {FullAccess, ExternalAccount, ReadPermission}
SharedMailbox_AT_xxx.com USER_AT_xxx.com {FullAccess}
SharedMailbox_AT_xxx.com daf(ServicePrincipal)... {FullAccess}

I also tried removing the cached MsalToken with "Clear-MsalTokenCache -FromDisk"

What i try:

.\Get-IMAPAccessToken.ps1 -tenantID "0xxx0" -clientId "7xxx4" -redirectUri "https://login.microsoftonline.com/common/oauth2/nativeclient" -LoginHint "User_AT_xxx.com" -SharedMailbox "SharedMailbox_AT_xxx.com"

And the error message is:

A01 BAD User is authenticated but not connected.
Causing Error: IMAP protcol access to mailbox is disabled or permission not granted for client credential flow. Please enable IMAP protcol access or grant fullaccess to service principal.

IMAP is enabled, the other two ways would not work if it was disabled.

Full-Access is granted for the User and the ServicePrincipal on the SharedMailbox.

Full-Access is granted since a few days so it should not be a replication issue.

Anything i can do there?

Best Regards