O365 mail Graph API Integration - Best Practices

[Moh.Yasser]

Hey all,

I was exploring O365 graph API and wondering what are some of the best practices for this integration.

One thing we came up was to IP restriction (Palo alto IP) in Microsoft side.

Are there any other condition access policies that can be added to make sure we follow best practices, other than securing the Palo alto tenant and Microsoft tenant as a whole? 

[SPatil15]

Hey,
You need to make sure below required permissions are enabled to run the O365 Outlook Mail (Using Graph API) integration commands successfully;

• Mail.ReadWrite - Application
• Mail.Send - Application
• MailboxSettings.ReadWrite - Application

[Moh.Yasser]

Yes. It depends on the usecase that we need to enable these permissions.

If its only for searching and deleting emails and sending emails, we wouldnt need access to Mailbox settings right?

Im looking to explore the best practices for the integration overall as this gives high privileges.

[SPatil15]

You can start with minimal permissions and see if the use case you trying works. As per our documentation, the above three permissions are required for all the commands to run. Also as stated in this doc use the client credentials flow instead of device code flow as a best practice.