Microsoft Graph
A Microsoft programmability model that exposes REST APIs and client libraries to access data on Microsoft 365 services.
12,935 questions
Various permissions
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(121.6, 16%, 21%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJR%3C/text%3E%3C/svg%3E)
Jacek Rogowski
20
Reputation points
In Azure on my account 'OdczytPocztyGHG->Permissions' there are two tabs with admin consent and user consent. All permissions are delegated. Accounts only in this organizational directory (single tenant)
In the Admin Consent tab there are permissions: email, EWS.AccessAsUser.All, IMAP.AccessAsUser.All, offline_access, openid and profile.
In the User Consent tab there are permissions: Mail.Read, User.Read, IMAP.AccessAsUser.All and offline_access.
The token includes all permissions: email, EWS.AccessAsUser.All, IMAP.AccessAsUser.All, Mail.Read, openid, profile and User.Read.
The questions are:
- Why is there no in token 'offline_access permission' if it appears in two tabs.
- Is this a possible reason for the inability to log in to the email account?
The token is obtained by entering the code on the page https://login.microsoftonline.com/common/oauth2/deviceauth and is generated after logging in to the account.
Tkoen:
aud: 00000003-0000-0000-c000-000000000000
scp: email EWS.AccessAsUser.All IMAP.AccessAsUser.All Mail.Read openid profile User.Read
Sign in to answer