What AAD flow do MS Graph explorer use ??

Vivek Satavase 31

We are trying to develop one SAP UI5 application with MS Graph API with a hybrid environment setup.
Initially it works(Started in August 2020) but stopped in DEC 2020.

We are using Mail, Events APIs in our application.

The same APIs are working in Graph explorer and not in the custom Application.

But the same application works for sample sandbox users.

There might be some problem with the configuration in Azure portal or may be in the authentication flow.

I have tried every authentication flow available in documents but still I facing the same issue.

HTTP error: 404
Error code: MailboxNotEnabledForRESTAPI or MailboxNotSupportedForRESTAPI
Error message: "REST API is not yet supported for this mailbox."

Can you please let us know what AAD Flow graph explorer use ?
Is there any document available about the registration of graph explorer?
Is it possible only graph explorer can access on-premise but custom apps can't?

Thank you,
Vivek

Jeevan-MSFT 81 Reputation points Microsoft Employee

2021-01-19T09:43:01.087+00:00

The mailbox error is happening because of the following 3 reasons

The mailbox is on a dedicated Microsoft Exchange Server or is not a valid Office 365 mailbox.
The mailbox is an Outlook.com account that hasn't been enabled yet.
The mailbox is not part of an Office 365 plan that includes Flow.

More information here https://learn.microsoft.com/en-us/exchange/troubleshoot/user-and-shared-mailboxes/rest-api-is-not-yet-supported-for-this-mailbox-error
Vivek Satavase 31 Reputation points

2021-01-19T09:50:49.86+00:00

@Jeevan-MSFT
We have a hybrid environmental setup for the target mailboxes.
If there is problem with mailbox, then the APIs should not be working from MS Grpah explorer also.

We don't understand how the same APIs was working in the same environment before, is not working now.

But if we use the token generated by graph explorer then it's working from the custom application also.

Regards,
Vivek
Jeevan-MSFT 81 Reputation points Microsoft Employee

2021-01-19T09:54:55.64+00:00

Can you please compare the access tokens generated by ms graph explorer and your custom app add to see if any of the scopes or roles ( in the case of client credentials flow ) are missing from the token obtained by your customer app's. You can view the token content at https://jwt.ms/
Vivek Satavase 31 Reputation points

2021-01-19T09:59:49.317+00:00

@Jeevan-MSFT
Yes we have compared the token using jwt.ms , scopes and other attributes are the same.

Only one property 'wids' is not available in the token of the custom app but present in graph explorer token.
Jeevan-MSFT 81 Reputation points Microsoft Employee

2021-01-19T10:22:22.273+00:00

Have you tried using the token with postman? Follow this guide to hit graph endpoints from postman https://learn.microsoft.com/en-us/graph/use-postman. This way you can isolate code issues in your custom app. Also, have you made sure the tenantID is the same for the flow from graph explorer and your custom app? The same user could be part of multiple tenants. Is this a multi-tenant app?
Vivek Satavase 31 Reputation points

2021-01-19T10:29:37.373+00:00

@Jeevan-MSFT

It is single tenant application. As we have checked in "/Authorize" url, the same tenant is used in both urls.

We will try and check with postman

Thank you
Priyadarshinee, Arpita (external) 21 Reputation points

2021-01-21T12:27:36.397+00:00
@Jeevan-MSFT
We have been facing the same issue and tried the methods you have suggested.
We tried the same APIs from Post man, It shows the the issue there as well.But it works for Graph explorer with same flow(Implicit).

We checked both token in jwt.ms and found that all other properties are same except for the "wids" property. Could this be the issue that we can not use APIs from our application?

Is it possible only graph explorer can access on-premise but custom apps can't?

Is there any other methods which I can try ?