EWS读取电子邮件和文件夹c#：权限和同意

Question

我正在尝试使用MSAL和EWS阅读收件箱中的电子邮件，到目前为止，我可以使用MSAL进行身份验证，但在阅读电子邮件时遇到了困难

如果我将Exchange API的应用程序API权限作为“full_access_as_app”提供，那么我就可以阅读收件箱文件夹中的电子邮件。但是，为了遵循最小特权原则，我不想使用完全访问权限选项。因此，当我撤销完全访问权限，然后仅为 Mail.Read 提供权限和同意时，我收到 401 错误：

Type: Microsoft.Exchange.WebServices.Data.ServiceRequestException
Stack trace:
at Microsoft.Exchange.WebServices.Data.ServiceRequestBase.GetEwsHttpWebResponse(IEwsHttpWebRequest request)
at Microsoft.Exchange.WebServices.Data.ServiceRequestBase.ValidateAndEmitRequest(IEwsHttpWebRequest& request)
at Microsoft.Exchange.WebServices.Data.MultiResponseServiceRequest`1.Execute()
at Microsoft.Exchange.WebServices.Data.ExchangeService.InternalCreateItems(IEnumerable`1 items, FolderId parentFolderId, Nullable`1 messageDisposition, Nullable`1 sendInvitationsMode, ServiceErrorHandling errorHandling)
at Microsoft.Exchange.WebServices.Data.Item.InternalCreate(FolderId parentFolderId, Nullable`1 messageDisposition, Nullable`1 sendInvitationsMode)
at Microsoft.Exchange.WebServices.Data.Item.Save(FolderId parentFolderId)
at Microsoft.Exchange.Tools.ExRca.Tests.CreateItemTest.PerformTestReally()
Exception details:
Message: The remote server returned an error: (401) Unauthorized.
Type: System.Net.WebException
Stack trace:
at System.Net.HttpWebRequest.GetResponse()
at Microsoft.Exchange.WebServices.Data.EwsHttpWebRequest.Microsoft.Exchange.WebServices.Data.IEwsHttpWebRequest.GetResponse()
at Microsoft.Exchange.WebServices.Data.ServiceRequestBase.GetEwsHttpWebResponse(IEwsHttpWebRequest request)```

I have tried few more permissions, such as below, but they haven't worked too:

Exchange.ManageAsApp
Mail.ReadWrite
MailboxSettings.Read
MailboxSettings.ReadWrite
User.Read.All

[API Permissions][1]

**Which are minimal permissions should be setup in order to read emails for a users mailbox folders?**

Thank you


  [1]: https://i.stack.imgur.com/xFub6.png

Answer 1

遗憾的是，由于 EWS 在这一点上是旧版 API，因此未实现更受约束的权限，因此唯一有效的两个作用域是 EWS。AccessAsUser.All 用于代理权限，full_access_as_app用于应用权限。如果需要使用更多受约束的权限，请查看使用图形 API。