Troubleshoot Exchange Online Using Microsoft Graph Explorer

Microsoft Graph Explorer is a developer tool that enables you to conveniently make Microsoft Graph REST API requests and view corresponding responses.

Use Graph Explorer to:

• Try APIs on the default sample tenant to explore capabilities
• Sign in to your own tenant and use it as a prototyping tool to fulfill your app scenarios
• Refer to documentation on using Graph Explorer.

Exchange Online API Permissions

Note that Exchange Online Targets configured in Sensitive Data Platform use an Azure App that requires the following Microsoft Graph permissions:

• Files.ReadWrite.All
• • Type: Application
  • Admin consent required: Yes
  • Description: Enables the app to read, create, update, and delete all files the service account user can access.
• Mail.ReadWrite
• • Type: Application
  • Admin consent required: Yes
  • Description: Enables the app to create, read, update, and delete mail in all mailboxes within an organization, without a signed-in user. This permission does not include the ability to send mail. Typically requires administrator consent to be granted.
• User.Read
• • Type: Delegated
  • Admin consent required: No
  • Description: Enables the app to read basic company information of users.
• User.ReadWrite.All
• • Type: Application
  • Admin consent required: Yes
  • Description: Enables the app to read and write all properties of user profiles.

Use Graph Explorer Validate Permissions and Content

Steps:

1. Navigate to the Graph Explorer Developer Tool.
2. Login as the account or service account being used to search the Exchange Account.
3. 1. See this article for required roles and delegated access.
      
      
3. Make sure to modify permissions so that you can successfully run queries:
   
   
4. Perform API calls to validate permissions and content.
5. • The Graph Explorer tool (in addition to other applications using APIs) may need consented access to perform certain calls. 
   • If so, a permissions error is given and can be updated under the Modify Permissions tab. 
   • This can happen even if the service account has the correct roles, as delegated permissions can be different per app.
   • Below is a list of calls that can be used in the third box to see what GraphAPI returns. 
   • • When performing a call, leave the first 2 drop-downs at GET and v1.0
     • Click ‘Run Query’ after each to get the response. 
   • The Spirion application finds only what is returned in GraphExplorer
   • • View what users this account has access to:
     • • https://graph.microsoft.com/v1.0/users
     • Verify if this account has access to a particular user account:
     • • https://graph.microsoft.com/v1.0/users/emailAddress
       • • Example:  https://graph.microsoft.com/v1.0/users/youradmin@yourdomain.com
     • Retrieve a list of folders and count of messages in a user’s account:
     • • https://graph.microsoft.com/v1.0/users/emailAddress/mailfolders
     • Retrieve a list of messages in a user’s account:
     • • https://graph.microsoft.com/v1.0/users/emailAddress/messages

Additional References

• https://docs.microsoft.com/en-us/graph/use-the-api
• https://docs.microsoft.com/en-us/graph/traverse-the-graph