PowerShell Script: Test mailbox access via Graph API

Use this script to test credentials for o365 mailbox access.

Note: Graph API is the modern approach to credentialing to Office 365 mailboxes. EWS is deprecated. Refer to the announcement here for more detail. All customers should migrate to Graph API mailbox access.

Requests for a Graph access token using client credentials
Calls /users/{mailbox}/messages to confirm the app can read the mailbox
Surfaces permission or consent issues cleanly

When you run this script, pay particular attention to the list of roles in the output. If you do not see Mail.ReadWrite output in the “roles:” section, permissions are wrong or missing.
Mailboxes MUST be licensed user mailboxes for use with Square 9 products. You many not use a shared or group mailbox.

PowerShell

# ============================================
# Variables
# ============================================
$tenantId     = "<TENANT_ID>"
$clientId     = "<CLIENT_ID>"
$clientSecret = "<CLIENT_SECRET>"
$mailbox      = "user@domain.com"
$folder       = "Inbox"

# ============================================
# Request OAuth2 Token for Microsoft Graph
# ============================================
$tokenBody = @{
    client_id     = $clientId
    scope         = "https://graph.microsoft.com/.default"
    client_secret = $clientSecret
    grant_type    = "client_credentials"
}

$tokenResponse = Invoke-RestMethod `
    -Method Post `
    -Uri "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" `
    -Body $tokenBody

$accessToken = $tokenResponse.access_token

if (-not $accessToken) {
    Write-Host "Failed to obtain access token" -ForegroundColor Red
    exit
}

Write-Host "Access token acquired successfully" -ForegroundColor Green

$payload = $accessToken.Split('.')[1].Replace('-','+').Replace('_','/')
while ($payload.Length % 4) { $payload += '=' }
$claims = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($payload)) | ConvertFrom-Json
"roles: $($claims.roles -join ', ')"
"appid: $($claims.appid)"

# ============================================
# Test Mailbox Access via Microsoft Graph
# ============================================
$headers = @{
    Authorization = "Bearer $accessToken"
}

$graphUrl = "https://graph.microsoft.com/v1.0/users/$mailbox/mailFolders/$folder/messages?`$top=10"

try {
    $result = Invoke-RestMethod -Method Get -Uri $graphUrl -Headers $headers
    Write-Host "Successfully accessed mailbox: $mailbox, Folder: $folder" -ForegroundColor Green

    if ($result.value) {
        Write-Host "Sample message:" 
        $result.value | Select-Object subject, receivedDateTime
    } else {
        Write-Host "Mailbox is accessible but contains no messages"
    }
}
catch {
    $resp = $_.Exception.Response
    if ($resp) {
        $reader = New-Object IO.StreamReader($resp.GetResponseStream())
        Write-Host $reader.ReadToEnd() -ForegroundColor Yellow
    }
    Write-Host $_.Exception.Message
}