Cannot Authenticate IMAP Desktop Application Using MailKit with Azure AD

[T-Bukovy]

Hi everyone,

I'm currently developing a desktop application C# that connects to an Office 365 mailbox using IMAP, with the Mailkit library. However, I keep running into an AuthenticationException:

i've created an Azure AD and granted all the permissions with admin consent and i used example code from the repo and Successfully retrieved the OAuth2 token using Microsoft Identity.

var result = await GetPublicClientOAuth2CredentialsAsync("IMAP", "[email protected]");

SaslMechanism oauth2;

using (var client = new ImapClient())
{
    await client.ConnectAsync("outlook.office365.com", 993, SecureSocketOptions.SslOnConnect);
    oauth2 = new SaslMechanismOAuth2(result.Account.Username, result.AccessToken);
    await client.AuthenticateAsync(oauth2);
    await client.DisconnectAsync(true);
}

scopes = new string[] {
     "email",
     "offline_access",
     "https://outlook.office.com/IMAP.AccessAsUser.All"
};

Is there a specific MailKit configuration for handling OAuth2 with Office 365's IMAP that I might be missing?
Thanks in advance for the help!

[jstedfast]

I believe you need to grant the "email", "IMAP.AccessAsUser.All", and "offline_access" permissions before it will work.

[T-Bukovy]

I've already granted the necessary permissions on Azure AD side. If thats what you are talking about.

[jstedfast]

Oh, I misunderstood what I was looking at in your screenshot I guess. I saw the "No" and thought that meant they weren't granted.

[T-Bukovy]

Yeah, the screenshot wasn't the best one.. And i'm kinda lost in this regard

[jstedfast]

Assuming you followed the directions in https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth correctly, it should be working.

There seems to be a powershell script at the end of that page that can be used to test things. Maybe try that and see how it goes?