OAuth2 Microsoft MailboxNotEnabledForRESTAPI Error

Nievelungen

Hey everybody.
We are currently updating our osTicket instance because Microsoft closed a hole that we were using previously to auth with Basic Auth.
So i have fully configured the OAuth2 - Microsoft config according to the Guideline.
But i get the Error 'MailboxNotEnabledForRESTAPI' after callback from Microsoft.

Settings:

The Mailbox has full Exchange Online integration and all possible stuff enabled, but i cant just get it to work.

Does someone have an Idea what could be wrong here?

Azure has been configured as in the Guide.

Is there some Log somewhere, where i can see the detailed response or something?

I am a developer but even i am lost on this.

Nievelungen

After some debugging i found out that if i use the Graph API not the Outlook Api and give Access to the application with our admin account, i get an access token for our admin account and not the account that i wanted to embbed.

This seems to cause issues, since now i have the wrong User.

KevinTheJedi

Nievelungen

When you authorize try signing into the email itself to authorize the scopes.

Cheers.

Nievelungen

KevinTheJedi
This only work if the user has consent rights if there is another Admin User to consent the request it returns the wrong user.
This promt in the URL thing breaks the whole thing, since it would only needed to be added once for MS stuff.

Nievelungen

Ok so i found out that the Plugin adds '&promt=constent' to the URL which basically breaks the whole flow.
If removed it works perfectly fine.
Also quick word from my sysadmin purposefully adding the 'promt=constent' to the URL can cause consent loops in the Auth Server which is pretty bad.

stiman

Nievelungen Yeah that works for me too.
But i see, in the Token tab, the token expires in +/- 1 hour. Or is that a normal thing?

KevinTheJedi

Nievelungen

Trust me, we know. This is why we are going to make it configurable in the future.

Cheers.

Nievelungen

stiman
Yeah JWT Tokens expire normally in 1 Hour, but the Plugin gets a new one when the old one expires (With the refresh Token).
This is default OAuth2 flow.
At least for me it works fine and the Plugin gets a new one automatically.

stiman

Nievelungen Ok, thx for the reply. I'll check this in 1 hour.

RyanLim

Hi, I've tried many great suggestions and still facing the same issues. Just cannot proceed from here. I can confirm that I am using a microsoft 365 account and not an exchange account.

ramrajone

RyanLim
Check this post it may help you
https://howtohelpdesk.com/how-to-setup-oauth-on-osticket-using-microsoft-365/

RyanLim

Hi ramrajone , thanks for your reply. I saw the link and follow all the steps. I keep getting

array('code' => 'MailboxNotEnabledForRESTAPI',''message'=>'The mailbox is either inactive,soft-deleted, or is hosted on-premise.',)

Not sure what i need to test or what logs to look for ? Any help will be appreicative.

ramrajone

RyanLim
That's an error most likely due to consent, double check and make sure you have given correct permission and also clear cache of your browser
https://howtohelpdesk.com/how-to-setup-oauth-on-osticket-using-microsoft-365/#allow-user-Consent

RyanLim

Hi ramrajone , thanks for all your help. I went back to check on my App Registration in Azure and discover i was creating it in a wrong Directory or Domain. After switching to the right directory .. it is working. Thanks for your help. 😃