Microsoft Graph Application permissions end up as delegated permissions when granted

I have an application in azure that I wish to send emails as a specific user.

1. I'm using the Mail.Send + offline_access defined as an Application permission.
2. I grant the permission from a user perspective with administrator right for the entire organization
3. Using the access token - from the user I'm able to send an email as that user which is logical.
4. When trying to send as another user I'm getting "Forbidden"

Looking at microsoft entra admin center for that application, the permission shows up as a "delegated" permission.

Does anyone have an idea if the access token generated from the user perspective is the one you should use for "Application" permissions or is there a different flow to get a separate access token for daemon services.

Kind regards Jens

You have mixed up Application and Delegated permission here. Having Mail.Send as an Application permission means you don't need the delegated permission. Scope is missing in the token because you don't have /.default scope.

If you decided to use delegated permissions, your app will be using an OAuth 2 flow like Auth Code flow for example and offline access + other delegated permissions will work here.

If you decide to use application permissions with say Client Credentials flow, offline_access is not applicable and only application permissions will apply.

In your case you need to just use application permissions and add the scope /.default with client credentials flow or while doing interactive login, you will then get an access token with Mail.Send in the roles scope. My advice is to choose which one fits your scenario and use just application or delegated permissions.