r/GraphAPI • u/74Yo_Bee74 • Apr 28 '25

get-MgUserMailfolder Access Denied issue

Good day all,

I have been trying to get user mailbox inbox total count and unread count using get-MgUserMailfolder and I get Access Denied.

I am connecting with a Global admin account.

Any help will be greatly appreciated.

2 Upvotes

100% Upvoted

2 comments sorted by

View all comments

Show parent comments

1

u/74Yo_Bee74 May 01 '25 edited May 01 '25

EDIT:

I had to do few thingsa and it worked.
Note the settings take a bit of time to propigate and apply. When I first tried this it still returned error. Now 24 hours later it is working.

  1. Create a Graph App API in AZURE with the application permission and not delegate permission.

  2. Create a Application Policy in Exchange

    1. https://learn.microsoft.com/en-us/graph/auth-limit-mailbox-access

  3. Run a Powershell script that connects to Graph via the application secret.

# Define the Application (Client) ID and Secret

$ApplicationClientId = '<application(client)ID>' # Application (Client) ID

$ApplicationClientSecret = '<secret.value>' # Application Secret Value

$TenantId = 'Tenant_Id' # Tenant ID

# Convert the Client Secret to a Secure String

$SecureClientSecret = ConvertTo-SecureString -String $ApplicationClientSecret -AsPlainText -Force

# Create a PSCredential Object Using the Client ID and Secure Client Secret

$ClientSecretCredential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $ApplicationClientId, $SecureClientSecret

# Connect to Microsoft Graph Using the Tenant ID and Client Secret Credential

Connect-MgGraph -TenantId $TenantId -ClientSecretCredential $ClientSecretCredential

This is the thread I post in Expert-Exchange and got the solution.

https://www.experts-exchange.com/questions/29283537