Using my own application id requires admin approval about office365apieditor HOT 8 CLOSED

Hi @sinag

Most probably you're using v2 app, switch to v1 app id and secret, grant necessary permissions once.

from office365apieditor.

what do you you mean switching to v1?
What I did was File->New Session->Use my application button

from office365apieditor.

sorry I was thinking that you're using Api Editor, not Mailbox Viewer.
In this scenario I guess you need to create an app in AAD, grant exchange permissions for this app and give admin consent

from office365apieditor.

Delegated permissions or application permissions?
Are these ok?
https://graph.microsoft.com/Calendars.Read
https://graph.microsoft.com/Calendars.ReadWrite
https://graph.microsoft.com/Contacts.Read
https://graph.microsoft.com/Contacts.ReadWrite
https://graph.microsoft.com/Mail.Read
https://graph.microsoft.com/Mail.ReadWrite
https://graph.microsoft.com/Tasks.Read
https://graph.microsoft.com/Tasks.ReadWrite
https://graph.microsoft.com/Mail.Send
https://graph.microsoft.com/User.ReadBasic.All

from office365apieditor.

To be more specific about the problem;
I have an account "[email protected]" which is from an azure active directory on a tenant and is using exchange online.
With this account, I can login with File->New Session->Sign-in
But if I try to use my own application id, which I have created with another trial personel account, than it requires admin approval from "yyy.com"

from office365apieditor.

@sinag
It seems that sign-in using your app (your application ID) is detected as a risky end-user consent request.
https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-user-consent?tabs=azure-portal#risk-based-step-up-consent

I could not repro the issue, and we have no way to know why your application ID is detected. Unfortunately, we can do nothing from the application side.

from office365apieditor.

great info thanks
my application's domain is not a verified domain, my guess is this could be an issue
what about disabling risk-based step-up consent?
according to my scenario this should be done on "yyy.com" side i guess

from office365apieditor.

Yes. If you want to disable risk-based step-up consent, you need to do it in the tenant which the end-user belongs to.
Though I'm not an Azure AD expert, I think disabling risk-based step-up consent is not recommended for security reasons.

from office365apieditor.