Email Sending through O365 using OAuth Protocol

 Microsoft Office365 EWS servers have been extended to support authorization via the industry-standard OAuth 2.0 protocol. Using OAUTH protocol, user can do authentication by Microsoft Web OAuth instead of inputting user and password directly in application

Microsoft / Office 365 OAuth + EWS

We can use the OAuth authentication service provided by Azure Active Directory to enable our application to connect with IMAP, POP or SMTP protocols to access Exchange Online in Office 365. To use OAuth with our application we need to register application on Azure Active directory and other steps also we need to do to get the access token back. Below are the steps

 

To use Microsoft/Office365 OAUTH in your application, you must create an application in https://portal.azure.com.

• Sign into the Azure portal using either a work or school account or a personal Microsoft account.
• If your account gives you access to more than one tenant, select your account in the top right corner, and set your portal session to the Azure AD tenant that you want.

·        In the left-hand navigation pane, select the Azure Active Directory service, and then select App registrations > New registration.

When the Register an application page appears, enter your application's registration information:

• Name - Enter a meaningful application name that will be displayed to users of the app.
•  
• Supported account types - Select which accounts you would like your application to support
• Redirect URI (optional) - Select the type of app you are building, Web or Public client (mobile & desktop), and then enter the redirect URI (or reply URL) for your application.

After entering all the above details then select Register button

Azure AD assigns a unique application (client) ID to app and to create client secret we need to do below step

click "Certificates and secrets" -> "client secrets" and add a new client secret.

Note: Please store "client secret" by yourself because it is hidden when you view it at next time.

---

API Permission

Click "API Permission" -> "Add a permission" -> "Exchange" -> "Delegated Permission" -> "Check EWS.AccessAsUser.All" -> "Add a permission" -> "Microsoft Graph" -> "Delegated Permission" -> "User.Read", "email", "offline_access", "openid" and "profile"

---

 

Authentication

·        Click "Authentication"

Implicit grant: check "Access tokens" and "ID tokens"

Redirect URI: input the URL to get authorization code, for native desktop application, you don't have to add redirect Uri.

• Mobile and desktop applications: redirect Uri, please check or add the following URI.

o   https://login.microsoftonline.com/common/oauth2/nativeclient

o   https://login.live.com/oauth20_desktop.srf

o   http://127.0.0.1

 

• Supported account types

please select Accounts in any organizational directory (Any Azure AD directory - Multitenant) and personal Microsoft accounts

·        Advanced settings

please set both "Live SDK Support" and "Treat application as a public client" to "Yes"

Above client_id and secret support both "Office365 + EWS" and "Live (hotmail, outlook personal account) + SMTP", Office365 Oauth doesn't support SMTP, only EWS is supported.

---

1.1        Use client id and client secret to get access token

We can use client id and client secret to get the user email address and access token like this:

• Application uses a web browser/browser control to open Microsoft OAUTH URL.
• User inputs user and password in Microsoft Web Authentication, Microsoft returns access token back to your application
• Application uses access token to access Microsoft Office 365/Live server.

If.NET framework version is v4.6.1 or later version, then we need to use Microsoft.Identity.Client to request access token directly.