Microsoft Graph: "ErrorAccessDenied" 403 App-Only Access Policy Error

Grace Wannapongsai
Grace Wannapongsai
  • Updated

Overview

This error occurs when Riva authenticates successfully to Microsoft Graph, but Exchange Online denies the Riva application access to the target mailbox. The denial occurs after authentication when Exchange evaluates the tenant's mailbox-scoped application policy.

Issue

Riva returns an error similar to the following:

Unable to initialize ... ErrorCode: ErrorAccessDenied, StatusCode: 403 ... Access to OData is disabled: [RAOP]: Blocked by tenant configured AppOnly AccessPolicy settings.

Riva may encounter this error while searching for the hidden RivaConfiguration item. The error does not necessarily mean that the configuration item is missing. It means that the application is not authorized to read the mailbox location where Riva stores or retrieves that configuration.

Cause

Possible causes include:

  • The mailbox is outside the access policy's permitted scope.
  • The mailbox is not a direct member of the mail-enabled security group used by the policy.
  • The policy references the wrong Riva application or client ID.
  • Another restrictive application access policy is taking precedence.
  • A recent policy or group-membership change has not finished propagating.

Resolution

  1. In Exchange Online PowerShell, run the following command against an affected mailbox:

    Test-ApplicationAccessPolicy -AppId "<Riva-Graph-App-Client-ID>" -Identity "<affected-user@domain.com>"
  2. Check the result. The expected result is AccessCheckResult: Granted.
  3. If the result is Denied, review the policy scope, the mailbox's direct membership in the mail-enabled security group, the application ID, and any other policies that apply to the same application.