My goal is to use the msgraph api via logic apps to query a shared mailbox and return the result for a keyword in the subject line.
Above is what i currently have written.
I would like to know if this query is correct.
What is the least privileged role i can give to an auth app registration or managed identity to achieve this task. ideally i dont want to give this app reg / identity permission to read anything other than the mailbox specified.
verify query:
https://graph.microsoft.com/v1.0/users/@{items('For_each_5')}/messages?$filter=from/emailAddress/address eq 'sharedmailbox@example.com.au' and toRecipients/any(r:r/emailAddress/address eq '@{items('For_each_5')}') and contains(subject, 'keyword')&$select=subject,from,toRecipients,receivedDateTime,bodyPreview
I think that toRecipients
is not supported when using $filter
. I would prefer to use $search
. The query will be more readable
https://graph.microsoft.com/v1.0/users/@{items('For_each_5')}/messages?$search="from:sharedmailbox@example.com.au and to:@{items('For_each_5')} and subject:keyword"&$select=subject,from,toRecipients,receivedDateTime,bodyPreview
The managed identity needs Mail.Read
application permission, but you can limit access to specific mailboxes.
https://learn.microsoft.com/en-us/graph/auth-limit-mailbox-access?view=graph-rest-1.0