Tools

WHD Microsoft 365 Modern Authentication: Incoming Emails Not Processed into Tickets, Graph API Access Denied (403) for Mail.Read

This article describes the “Graph API access denied (status 403). Check Mail.Read permissions.” error and the issue where incoming emails are not processed into WHD tickets after setting up Microsoft 365 Modern Authentication.

First published date

11/11/2026 9:40 AM

Last published date

11/11/2026 9:40 AM

Overview

For Microsoft 365 mailboxes, only modern authentication is supported in WHD.

With that, it is necessary to have the API permissions of Azure APP for WHD correctly configured in order for WHD to manage the mailboxes and turn them into tickets.

Ref: Configure an incoming email account for Microsoft 365

Product section

Web Help Desk

Cause

  • WHD Azure APP Registration API permission is missing
  • Granting admin consent for {your tenant} is not configured.

Resolution

  1. On the Home page under Azure services, click Azure Active Directory. 
  2. In the navigation pane under Manage, click App registrations.
  3. Select the App registration created for WHD
  4. In the navigation menu, click API Permissions.
  5. In the Request API permissions sidebar, search for and enable the required permissions.
    The following table lists the permissions to enable on this screen.
    PermissionAccessDescription
    Mail.ReadWriteRead and write access to user mailAllows the app to create, read, update, and delete email in user mailboxes. Does not include permission to send mail.
    emailView the user's email addressAllows the app to read your users' primary email address.
    offline_accessAccess the user's data anytimeAllows the app to read and update the user's data, even when the user is not currently using the application.
    User.ReadSign-in and read user profileAllows users to sign in to the app, and allows the app to read the profile of signed-in users. It also allows the app to read basic company information of signed-in users.
    Mail.Send (if the incoming email is the same as outgoing email)   Send mail as a user Allows the app to send mail as you.
  6. Click Grant admin consent for {your tenant}, which allows an admin to grant admin consent to the permissions configured for the application. When you select the button, a dialog requests that you confirm the consent action.

  7. After you have granted consent, the permissions that required admin consent are shown as having consent granted.

    If you are not the tenant admin or if no permissions have been configured for the application, the Grant admin consent button is disabled.

    If permissions were granted but not yet configured, the admin consent button prompts you to handle these permissions. You can add them to configured permissions or remove them.

  8. Remove any other preexisting permissions from the remaining permission drop-down menus.