I have an application in azure that I wish to send emails as a specific user.
Mail.Send
+ offline_access
defined as an Application
permission.Looking at microsoft entra admin center for that application, the permission shows up as a "delegated" permission.
Does anyone have an idea if the access token generated from the user perspective is the one you should use for "Application" permissions or is there a different flow to get a separate access token for daemon services.
Kind regards Jens
You have mixed up Application and Delegated permission here. Having Mail.Send
as an Application permission means you don't need the delegated permission. Scope is missing in the token because you don't have /.default
scope.
If you decided to use delegated permissions, your app will be using an OAuth 2 flow like Auth Code flow for example and offline access + other delegated permissions will work here.
If you decide to use application permissions with say Client Credentials flow, offline_access
is not applicable and only application permissions will apply.
In your case you need to just use application permissions and add the scope /.default
with client credentials flow or while doing interactive login, you will then get an access token with Mail.Send
in the roles scope. My advice is to choose which one fits your scenario and use just application or delegated permissions.