Get 'Access to OData is disabled' error even though User-Agent is set in header

[fangzhoulu-hiretual]

Bug Report

Prerequisites

• Can you reproduce the problem?
• Are you running the latest version?
• Are you reporting to the correct repository?
• Did you perform a cursory search?

Description

We are trying to create subscription on a exchange server whose EWS settings is EwsApplicationAccessPolicy : EnforceAllowList with EWSAllowList including our USER_AGENT,.However, we keeps getting Access to OData is disabled error.

The code is like:

const response = await client.api('/subscriptions').header('User-Agent', USER_AGENT).post({
  changeType: 'created',
  notificationUrl: process.env.OUTLOOK_WEBHOOK_URL,
  resource: '/me/messages',
  expirationDateTime: moment().add(SUBSCRIPTION_EXPIRE_TIME, 'minutes'),
  clientState: 'Something'
});

From the server log, the user agent inside header is still empty.
Refer: https://blogs.msdn.microsoft.com/wushuai/2017/04/01/how-to-fix-access-to-odata-is-disabled-when-calling-graph-api/

Error code:

{"statusCode":403,"code":"ExtensionError","message":"Operation: Create; Exception: [Status Code: Forbidden; Reason: Access to OData is disabled.]","requestId":"9af7d935-5ddc-4f2a-aa15-e7d35aa235b1","date":"2019-11-18T14:55:33.000Z","body":"{\"code\":\"ExtensionError\",\"message\":\"Operation: Create; Exception: [Status Code: Forbidden; Reason: Access to OData is disabled.]\",\"innerError\":{\"request-id\":\"9af7d935-5ddc-4f2a-aa15-e7d35aa235b1\",\"date\":\"2019-11-18T14:55:33\"}}"}

[MIchaelMainer]

Are you using an on-premise Exchange Server? You can't use Microsoft Graph API with on-premise Exchange.

This issue has been automatically marked as stale because it has been marked as requiring author feedback but has not had any activity for 4 days. It will be closed if no further activity occurs within 3 days of this comment.

[fangzhoulu-hiretual]

It does work with this email server until the EwsApplicationAccessPolicy is changed.
I think it is hybrid.

[hongtaozhang233]

@MIchaelMainer Hi Michael, we are using O365 which is cloud-based.

[MIchaelMainer]

Just to be clear, let me know if I understand correctly...

This is targeting a user's mailbox (delegated permissions) and may be part of a hybrid environment where some users are hosted on an on-premise Exchange Server and others in Exchange Online. Microsoft Graph subscriptions that target /messages work as expected when the EwsApplicationAccessPolicy is not set. When EwsApplicationAccessPolicy : EnforceAllowList with EWSAllowList is set, this no longer works and you see the error message you previously reported. Is my understanding correct?

[hongtaozhang233]

Hi Michael,
Yes it is targeting a user's mailbox (Office 365) but I am not sure if it is a hybrid environment or a pure cloud-based environment. The second part is correct.

[MIchaelMainer]

@hongtaozhang233

Thank you for the response. Can you confirm that the User Agent string sent over the wire matches the one set in the EWSAllowList? Can you provide a requestId from the error response so I can look this up?

[hongtaozhang233]

@MIchaelMainer
Hi Michael, Yes the User Agent is 'HiretualApp/' and the EWSAllowList is set as 'Hiretual'. Actually we tried several cases like "HiretualApp", "HiretualApp/*" but none of them work.