API Mailbox Item Import

Question

API Mailbox Item Import

Jan Berlinger - credaris.ch 0

Hi there

We would like to create an Exchange import session to prepare an import of an EML file to Outlook.

POST https://graph.microsoft.com/beta/admin/exchange/mailboxes/******@domain.com/createImportSession

API documented here: https://v4.hkg1.meaqua.org/en-us/graph/import-exchange-mailbox-item.

We use the application permission MailboxItem.ImportExport.All in the App Registration (with admin grant).

The session gets successfully established and as a respones we get the ImportUrl:
https://outlook.office365.com/api/gbeta/Mailboxes('MBX:<ID>')/importItem?authtoken=<token>

Still, when we use the ImportUrl to upload the file, we receive an 403 Forbidden response.

JSON Body:

{
"FolderId":"<FolderId>",
"Mode":"create",
"Data":"<Base64Payload>"
}

In the response header we see the following header:

WWW-Authenticate: Bearer client_id="<clientId>", trusted_issuers="<issuerId@*", token_types="app_asserted_user_v1 service_asserted_app_v1", error="invalid_token"

As the request is preauthenticated I would not expect this error at all.

Do you know if we need to fulfill additional pre-requisites to successfully import the document?

Thanks,

2 answers

Your answer

Answer 1

It sounds like you are encountering a 403 Forbidden error when trying to upload the item using the ImportUrl after successfully creating the import session. This error typically indicates that there are issues with the authentication token or permissions.

Here are a few things you can check:

Token Validity: Ensure that the token you are using in the ImportUrl is still valid and has not expired. The expirationDateTime property in the mailboxItemImportSession response indicates how long the token is valid.
Permissions: Double-check that the application permission MailboxItem.ImportExport.All is correctly granted and that the user or service principal making the request has the necessary permissions to perform the import operation.
Correct FolderId: Make sure that the FolderId you are providing in the JSON body is valid and that the user has access to that folder.
Base64 Encoding: Verify that the data you are sending in the Data field is correctly base64 encoded and represents a valid EML file.

If all of these checks are correct and you are still facing issues, you may want to review the API documentation for any additional requirements or reach out to Microsoft support for further assistance.

References:

Answer 2

Vergil-V 7,550 Microsoft External Staff Moderator

Hi @Jan Berlinger - credaris.ch
Thanks for reaching out to the Microsoft Q&A forum. I appreciate the details you shared along with the documentation link.

After reviewing the article you provided and your description, I noticed that the data used in step 2, "Use the import URL to upload an item", is expected to be in Base64-encoded FTS format.

User's image Regarding the 403 Forbidden responses with Data: "<Base64Payload>", may I confirm whether this payload is a Base64-encoded EML file?

Additionally, please note that an Exchange mailbox item needs to be exported first before it can be imported into another folder. This ensures the item data is in the correct Base64-encoded FTS format.

undefined For importing an EML file, Microsoft Graph supports scenarios where EML can be imported as a MIME format draft message. You can refer to this example:

undefined Reference: Create message - Microsoft Graph v1.0 | Microsoft Learn

If you want to use mailbox import and export APIs for EML files, you can import the EML file into Outlook either by using the above API to create a draft message or by importing it directly into any folder through the New Outlook desktop version.

undefined

Once the items are imported, you can export them using exportItems. After you have the correct data format, try reproducing the steps to check if the issue persists.

I sincerely hope this information helps clarify your situation and supports you in resolving the issue. Please don’t hesitate to reply if you have any updates.

Thank you for your understanding.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Jan Berlinger - credaris.ch 0 Reputation points

2025-11-25T14:59:02.85+00:00

Hi Vergil

Thanks for your valuable feedback!

Indeed we did not pay attention to the FTS format. So we tried to change the flow to explicitly export the item first with the exportItem endpoint.

Then we used the data parameter from the response to import the file within the freshly created import session.

Still we are facing the exact same error on the response: 403

POST
https://graph.microsoft.com/beta/admin/exchange/mailboxes/****@domain.com/exportItems

Request

{

"itemIds": [

"{{ $json.id }}"

]

}

Response

[

{

"@odata.context"``: "https://graph.microsoft.com/beta/$metadata#Collection(microsoft.graph.exportItemResponse)",

"value"``: [

{

"itemId"``: "<itemId>",

"changeKey"``: "<changeKey>",

"data"``: "<base64data>"

}

]

}

]

Then a POST for the import session:

https://outlook.office365.com/api/gbeta/Mailboxes('MBX:<ID>')/importItem?authtoken=<token>

{ "FolderId":"<FolderId>", "Mode":"create", "Data":"<Base64PayloadFromExportItem>" }
Vergil-V 7,550 Reputation points Microsoft External Staff Moderator

2025-11-26T10:05:03.8833333+00:00
Hi @Jan Berlinger - credaris.ch
Thank you for your update.

Could you please confirm whether the 403 response still includes WWW-Authenticate: Bearer client_id="<clientId>"?

Please remember not to add the Authorization header when importing items.

Additionally, you can run the Test-ServicePrincipalAuthorization cmdlet to verify the access granted by role-based access control (RBAC) for applications.

Test-ServicePrincipalAuthorization -Identity <ObjectID, AppID, or DisplayName> [-Resource] <target mailbox>

If the output shows InScope: False, you need to assign the Mailbox Import Export role to your app:

New-ManagementRoleAssignment [[-Name] <String>] -Role "Mailbox Import Export" -App <ObjectID, AppID, or DisplayName>

For more details, please refer to: Role Based Access Control for Applications in Exchange Online | Microsoft Learn

I hope this provides additional insight. If you have any updates, feel free to reply.
Jan Berlinger - credaris.ch 0 Reputation points

2025-11-26T14:41:27.77+00:00

Hi Vergil

Thanks for your help an patience! :)

I can confirm, that we still receive the response header WWW-Authenticate: Bearer client_id="<clientId>"?

Also I can confirm, that we do not send any authentication header within the request, tested with several API client applications.

The Test-ServicePrincipalAuthorization failed during the request:

Test-ServicePrincipalAuthorization: ||The operation could not be performed because the object '<App-ID>' was not found on '<id1>.<id2>.PROD.OUTLOOK.COM' was not found.

I've tried this with multiple ExchangeOnline sessions.

Also creating a new one fails:

New-ManagementRoleAssignment -Name "<name>" -Role "Mailbox Import Export" -App '<App-ID>'

New-ManagementRoleAssignment: ||No service principal with the following identity was found: "<App-ID>".

Regards
Vergil-V 7,550 Reputation points Microsoft External Staff Moderator

2025-11-30T16:03:51.4066667+00:00
Hi @Jan Berlinger - credaris.ch
Thank you for your follow-up and patience.

Could I clarify the PowerShell command:

New-ManagementRoleAssignment -Name "<name>" -Role "Mailbox Import Export" -App "<App-ID>"

You are currently using the App ID. In this case, please replace it with the ObjectID, as described in New-ManagementRoleAssignment (ExchangePowerShell) | Microsoft Learn

You can retrieve the ObjectID in Microsoft Entra Admin Center or by running:

Get-MgServicePrincipal -Filter "DisplayName eq 'App Name'" | Format-List Id, DisplayName

I sincerely apologize for not making this clear in my previous response. I hope this helps clarify the situation and supports you in moving forward.

I look forward to your update.
Vergil-V 7,550 Reputation points Microsoft External Staff Moderator

2025-12-01T13:08:10.1566667+00:00

Hi @Jan Berlinger - credaris.ch
I just wanted to kindly follow up to see if you’ve had a chance to review my previous response.
I would greatly appreciate any updates you may be able to provide, particularly regarding the usefulness of the information we shared. Your feedback is essential to our ongoing efforts to enhance the quality of our support.

Thanks again for your time, and we look forward to hearing from you
Jan Berlinger - credaris.ch 0 Reputation points

2025-12-01T14:28:28.1833333+00:00

Hi Vergil

Thanks for your input.

Indeed, I was able to register the Service Principal (it was not there before).

Test-ServicePrincipalAuthorization -Identity <id> -Resource ***@domain.com

RoleName GrantedPermissions AllowedResourceScope ScopeType InScope

-------- ------------------ -------------------- --------- -------

Mailbox Import Export New-MailboxImportRe… Organization Organization True

Still, the error during importing exists as before, while the exportItem works perfectly fine. Do we need to wait for Exchange Synch processes to test again after a few hours, maybe?
Vergil-V 7,550 Reputation points Microsoft External Staff Moderator

2025-12-02T14:34:48.8+00:00

Hi @Jan Berlinger - credaris.ch
Thank you for following up.

Could you please share a screenshot of the output when uploading an item using a fresh ImportURL, especially the part where the response shows the 403 error?

I’d like to review it to see if I can gather any helpful insights. Please check your inbox for an email with the subject “New private message on Microsoft Q&A question” to view my response.

I look forward to your update.
Vergil-V 7,550 Reputation points Microsoft External Staff Moderator

2025-12-05T13:07:26.7633333+00:00

Hi @Jan Berlinger - credaris.ch

Hope you're having a good day.
May I ask if there have been any updates regarding the 403 error when importing items using Graph API?
Have you had a chance to review the responses shared so far in the private message?
I’d appreciate any updates you can provide, and please let me know if there’s anything further I can do to assist.
Vergil-V 7,550 Reputation points Microsoft External Staff Moderator

2025-12-10T14:52:40.3833333+00:00

Hi @Jan Berlinger - credaris.ch
Whenever it’s convenient for you, please review my latest response in the private message.
I look forward to hearing from you soon.

Share via

API Mailbox Item Import

2 answers

Your answer