I'm currently looking at this https://learn.microsoft.com/en-us/graph/webhooks#subscription-request-example
which for convenience I'll provide a screenshot of below
and the highlighted part confuses me. How exactly does someone go about giving my app permission to subscribe to their mailbox resource?
Permissions (scopes) are requested by an application within a context:
Depending on the "impact" of a permission, and on policies that can be defined by the tenant administrators, user can consent (or not) to certain permission requests on the resources they own (in the case of a delegated context, app-only permissions always require admin consent).
Generally speaking, the permissions required to subscribe to a certain resource are the same that are required to read the resource.
You can find a reference of which permission is required for which resource here.
If we take the example of messages (emails) it requires the Mail.Read
permission to subscribe. In general this permission can be consented by regular users and does not require an administrator. However administrators can setup policies to require that administrator consent, preventing users from consenting directly themselves.