CODEWITHSUNDEEP
rmicrosoft-graph-api
Wiktor Gustafsson
Wiktor Gustafsson

Reputation: 182

Microsoft Graph API - error 403 "Insufficient privileges to complete the operation"

I'm trying to use the AzureR family of R packages to interact with Outlook through the Graph API. Using Microsoft365R I have the following code:

outl <- get_business_outlook(
  tenant = tenant_id,
  app = client_id,
  password = client_secret
)

But this results in a 403 error:

Error in process_response(res, match.arg(http_status_handler), simplify) : Forbidden (HTTP 403). Failed to complete operation. Message: Insufficient privileges to complete the operation.

The app in question has the API permissions Mail.ReadWrite, Mail.ReadWriteShared, Mail.Send, Mail.Send.Shared, offline_access, openid, User.Read.

I also tried using the AzureGraph package directly like:

login <- create_graph_login(
  tenant = tenant_id,
  app = client_id,
  password = client_secret
)

This works and I get a token. I then try to extract user information with me <- login$get_user(), but this throws the same 403 error as above. I suspect there is something I need to do to actually authenticate the user, but I can't really figure out what.

I am entirely new to the Graph API so it's very possible that I have missed something obvious. Any help appreciated!

Upvotes: 2

Views: 2027

Answers (1)

Hong Ooi
Hong Ooi

Reputation: 57696

Microsoft365R/AzureGraph author here. In the code you show, both with get_business_onedrive() and create_graph_login(), you are authenticating as the app, not as the user. This means that there is no user account involved, hence you're unable to view user details or send email.

To authenticate as the user, run

# Microsoft365R
get_business_outlook("tenant_id", app="client_id")

# AzureGraph
create_graph_login("tenant_id", app="client_id")

ie, without the password argument. You should know it's working if R opens up a browser window for you to login to Azure (or to show it's successfully logged in).

The latest revision of the AzureAuth package has a vignette that explains a bit more on the various authentication scenarios. AzureAuth::get_azure_token is the underlying function used to obtain an OAuth token by Microsoft365R and AzureGraph, and you can pass down the arguments mentioned in the vignette from get_business_outlook and create_graph_login.

Upvotes: 2

Related Questions