Microsoft Office365 Pop3 Authentication Failed Using OAuth2 in C#

[rakshit-astotek]

I am trying to connect pop3email client with token based authentication

to create token, I have registered app in azure and using below details to generate token:

endpoint : https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token
grant : client_credentials
scope : https://outlook.office365.com/.default

token is getting generated successfully but while passing that token to pop3emailclient to connect to server getting authentication failed error.

I have provided below permissions to registered app:

Office 365 Exchange Online

Mail.Read

Mail.Read.All

Mail.Read.Shared

POP.AccessAsApp

Also tried with graph api permissions:

POP.AccessAsUser.All

offline_access

email

Mail.Read

Mail.ReadBasic.All

I tried with 2 approaches but in both I am getting authentication failed error

Approach 1

    var tokenEndpoint = $"https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token";
    var requestBody = new FormUrlEncodedContent(new[]
    {            new KeyValuePair<string, string>("client_id", clientId),
    new KeyValuePair<string, string>("scope", "https://outlook.office365.com/.default"),
    new KeyValuePair<string, string>("client_secret", clientSecret),
    new KeyValuePair<string, string>("grant_type", "client_credentials")
});
    var response = await client.PostAsync(tokenEndpoint, requestBody);
    response.EnsureSuccessStatusCode();

    var responseBody = await response.Content.ReadAsStringAsync();
    var tokenResponse = JObject.Parse(responseBody);
    var accessToken = tokenResponse["access_token"].ToString();
 var emailClient = new Pop3Client(new ProtocolLogger("log/pop3.log"));
var oauth2Token = new SaslMechanismOAuth2(_emailConfiguration.PopUsername, accessToken);
await emailClient.AuthenticateAsync(oauth2Token);

Approach 2

 var scopes = new string[] {
        "https://outlook.office.com/.default",
};
 var confidentialClientApplication = ConfidentialClientApplicationBuilder
          .Create(_emailConfiguration.ClientId)
          .WithClientSecret(_emailConfiguration.ClientSecret)
          .WithTenantId(_emailConfiguration.TenantId)
          .WithAuthority(new Uri("https://login.microsoftonline.com/" + _emailConfiguration.TenantId + "/"))
          .Build();

  var authenticationResult = await confidentialClientApplication.AcquireTokenForClient(scopes).ExecuteAsync();

  var authToken = authenticationResult;
  var oauth2 = new SaslMechanismOAuth2(_emailConfiguration.PopUsername, authToken.AccessToken);

  Pop3Client emailClient = null;
  using (var client = new Pop3Client(new ProtocolLogger("log/pop3.log")))
  {
      emailClient = client;
      client.Connect("outlook.office365.com", 993, SecureSocketOptions.SslOnConnect);
      client.Authenticate(oauth2);
      client.Disconnect(true);
  }

[jstedfast]

At the end of Microsoft's documentation, they provide a link to a test program using powershell that you can run to validate that everything is configured correctly.

https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth

Have you run this? Did it work?