Graph mailboxes export-import forbidden

Can you check if your code is posting exactly to the r2.importUrl returned by Graph, without manually appending headers like Authorization: Bearer or altering query parameters?

As a quick test, retry the import with a minimal request using only the Content-Type: application/json header.

Interesting. Nested app auth issues tokens scoped to Outlook, not your Graph app. The import/export API only accepts a Graph token issued directly for your app.

Are you exchanging the nested token using the On-Behalf-Of flow before calling the import endpoint? If not, that’s why the 403 appears, the token audience doesn’t match.

Use this flow so your add-in gets its own valid Graph token: Enable nested app authentication – On-Behalf-Of flow

Im using the code from that link with a little extra chaining.

import { createNestablePublicClientApplication } from "@azure/msal-browser";
let pca = undefined;
Office.onReady(async (info) => {
  if (info.host === Office.HostType.Outlook) {
    // Initialize the public client application
    pca = await createNestablePublicClientApplication({
      auth: {
        clientId: "",
        authority: "https://login.microsoftonline.com/common",
      },
    });
    run2();
  }
});
async function run2() {
  // Specify minimum scopes needed for the access token.
  const tokenRequest = {
    scopes: [
      "Mail.ReadBasic",
      "Mail.ReadWrite.Shared",
      "Files.Read",
      "User.Read",
      "openid",
      "Device.Command",
      "Device.Read",
    ],
  };
  let accessToken = null;
  // TODO 1: Call acquireTokenSilent.
  try {
    console.log("Trying to acquire token silently...");
    const userAccount = await pca.acquireTokenPopup(tokenRequest);
    console.log("Acquired token silently.");
    accessToken = userAccount.accessToken;
  } catch (error) {
    console.log(`Unable to acquire token silently: ${error}`);
  }
  // TODO 2: Call acquireTokenPopup.
  if (accessToken === null) {
    // Acquire token silent failure. Send an interactive request via popup.
    try {
      console.log("Trying to acquire token interactively...");
      const userAccount = await pca.acquireTokenSilent(tokenRequest);
      console.log("Acquired token interactively.");
      accessToken = userAccount.accessToken;
    } catch (popupError) {
      // Acquire token interactive failure.
      console.log(`Unable to acquire token interactively: ${popupError}`);
    }
  }
  // TODO 3: Log error if token still null.
  // Log error if both silent and popup requests failed.
  if (accessToken === null) {
    console.error(`Unable to acquire access token.`);
    return;
  }
  console.log(Office.context.mailbox.item.itemId)
  // TODO 4: Call the Microsoft Graph API.
  // Call the Microsoft Graph API with the access token.
     const response = await fetch(
    `https://graph.microsoft.com/beta/admin/exchange/mailboxes/{usermailboxs}/exportItems`,
    {
      method: "POST",
      headers: {
        Authorization: accessToken,
        "Content-type": "application/json",
      },
      body: "{'itemIds' : ['AAMkAGM3ODY.....']}",
    }
  );
  if (response.ok) {
    const data = await response.json().then(async (r) => {
      const importses = await fetch(
        `https://graph.microsoft.com/beta/admin/exchange/mailboxes/{shared mailbox}/createImportSession`,
        {
          method: "POST",
          headers: {
            Authorization: accessToken,
            "Content-type": "application/json",
          },
        }
      );
      if (importses.ok) {
        const importsesdata = await importses.json().then(async (r2) => {
          console.log (r2)
        const importop = await fetch(
        r2.importUrl,
        {
          method: "POST",
          headers: {
                "Content-type": "application/json",
      },
          body:'{"FolderId": "Inbox", "Mode":"create","Data":"'+r.value[0].data+'"}'
        }
      );
        });
      }
    });

When you decode accessToken at jwt.ms, what’s the aud value? If it’s 00000002-0000-0ff1-ce00-000000000000, it’s an Outlook token and Graph will always return 403.

Also, make sure to configure the Azure AD web API app for On-Behalf-Of flow with client secret or certificate to exchange that Outlook token for a real Graph token (aud = 00000003-0000-0000-c000-000000000000)? Without this exchange, /admin/exchange calls won’t authenticate.

It is a Graph token.

I tried doing the import in the logind users mailbox and here everything works as expected. So i'm guessing that the app is running in the logged in users context, and I therefore need to either give the user permission i the Exchange admin center or make the app work in app context.

If i understand it correctly, the import-export permission i give in app registration is only for app context and not the user. I guess that's what you mean with On-Behalf-Of flow.