---
title: "Troubleshoot Exchange Online Using Microsoft Graph Explorer"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/troubleshoot-exchange-online-using-microsoft-graph-explorer"
language: "en"
last_updated: "2025-11-14T15:44:22.737Z"
---

# Troubleshoot Exchange Online Using Microsoft Graph Explorer

Perform API calls to validate permissions and content.

Microsoft [Graph Explorer](https://developer.microsoft.com/graph/graph-explorer/) is a developer tool that enables you to conveniently make Microsoft Graph REST API requests and view corresponding responses.

Use Graph Explorer to:

-   Try APIs on the default sample tenant to explore capabilities
-   Sign in to your own tenant and use it as a prototyping tool to fulfill your app scenarios
-   Refer to [documentation](https://docs.microsoft.com/en-us/graph/graph-explorer/graph-explorer-overview) on using Graph Explorer.

## Exchange Online API Permissions

Note that Exchange Online Targets configured in Sensitive Data Platform use an Azure App that requires the following Microsoft Graph permissions:

-   **Files.ReadWrite.All**
-   -   Type: Application
    -   Admin consent required: Yes
    -   Description: Enables the app to read, create, update, and delete all files the service account user can access.
-   **Mail.ReadWrite**
-   -   Type: Application
    -   Admin consent required: Yes
    -   Description: Enables the app to create, read, update, and delete mail in all mailboxes within an organization, without a signed-in user. This permission does not include the ability to send mail. Typically requires administrator consent to be granted.
-   **User.Read**
-   -   Type: Delegated
    -   Admin consent required: No
    -   Description: Enables the app to read basic company information of users.
-   **User.ReadWrite.All**
-   -   Type: Application
    -   Admin consent required: Yes
    -   Description: Enables the app to read and write all properties of user profiles.

## Use Graph Explorer Validate Permissions and Content

Steps:

1.  Navigate to the [Graph Explorer Developer Tool](https://developer.microsoft.com/en-us/graph/graph-explorer).
2.  Login as the account or service account being used to search the Exchange Account.
3.  1.  See this [article](https://spirion-kgsy.help.userguiding.com/en/articles/12256-how-to-search-microsoft-office-email-using-modern) for required roles and delegated access.  
          
        ![](https://media.userguiding.com/files/knowledge-base/95602/file-1751314697128.png)
4.  Make sure to modify permissions so that you can successfully run queries:  
      
    ![](https://media.userguiding.com/files/knowledge-base/95602/file-1751314732868.png)
5.  Perform API calls to validate **permissions** and **content**.
6.  -   The Graph Explorer tool (in addition to other applications using APIs) may need consented access to perform certain calls. 
    -   If so, a permissions error is given and can be updated under the **Modify Permissions** tab. 
    -   This can happen even if the service account has the correct roles, as **delegated permissions can be different per app**.
    -   Below is a list of calls that can be used in the third box to see what GraphAPI returns. 
    -   -   When performing a call, leave the first 2 drop-downs at **GET** and **v1.0**
        -   Click ‘Run Query’ after each to get the response. 
    -   The Spirion application finds only what is returned in **GraphExplorer**
    -   -   View what users this account has access to:
        -   -   [https://graph.microsoft.com/v1.0/users](https://graph.microsoft.com/v1.0/users)
        -   Verify if this account has access to a particular user account:
        -   -   [https://graph.microsoft.com/v1.0/users/emailAddress](https://graph.microsoft.com/v1.0/users/emailAddress)
            -   -   Example:  [https://graph.microsoft.com/v1.0/users/youradmin@yourdomain.com](https://graph.microsoft.com/v1.0/users/youradmin@yourdomain.com)
        -   Retrieve a list of folders and count of messages in a user’s account:
        -   -   [https://graph.microsoft.com/v1.0/users/emailAddress/mailfolders](https://graph.microsoft.com/v1.0/users/emailAddress/messages)
        -   Retrieve a list of messages in a user’s account:
        -   -   [https://graph.microsoft.com/v1.0/users/emailAddress/messages](https://graph.microsoft.com/v1.0/users/emailAddress/messages)

## Additional References

-   [https://docs.microsoft.com/en-us/graph/use-the-api](https://docs.microsoft.com/en-us/graph/use-the-api)
-   [https://docs.microsoft.com/en-us/graph/traverse-the-graph](https://docs.microsoft.com/en-us/graph/traverse-the-graph)