Can users consent to Mail.ReadWrite.Shared themselves?

Yes, this delegated permission allows user consent. Users can grant this permission during sign-in without admin approval.

How do I add Mail.ReadWrite.Shared to my app registration?

Go to Azure Portal > App registrations > Your app > API permissions > Add permission > Microsoft Graph, then search for Mail.ReadWrite.Shared and select it.

Mail.ReadWrite.Shared Permission - Microsoft Graph API

Permission Details

Delegated Permission

Read and write user and shared mail

Allows the app to create, read, update, and delete mail a user has permission to access, including their own and shared mail. Does not include permission to send mail.

Permission ID: 5df07973-7d5d-46ed-9847-1271055cbd51

Properties

Property	Type	Description
`id`	`string`	The unique identifier for an entity. Read-only.
`deliveryStatus`	`microsoft.graph.messageStatus`
`events`	`microsoft.graph.messageEvent collection`
`recipientEmail`	`string`

Relationships

Relationship	Type	Description
`attachments`	`attachment collection`	The fileAttachment and itemAttachment attachments for the message.
`extensions`	`extension collection`	The collection of open extensions defined for the message. Nullable.
`singleValueExtendedProperties`	`singleValueExtendedProperties collection`	The collection of single-value extended properties defined for the message. Nullable.
`multiValueExtendedProperties`	`multiValueExtendedProperties collection`	The collection of multi-value extended properties defined for the message. Nullable.

Graph Methods

Delegated access App-only access

No API methods available for this version.

No PowerShell cmdlets found for this permission.

Code Examples

C# / .NET SDK

// Install: dotnet add package Microsoft.Graph
// Install: dotnet add package Azure.Identity
using Microsoft.Graph;
using Azure.Identity;

// Delegated permissions - interactive user sign-in
var scopes = new[] { "Mail.ReadWrite.Shared" };
var options = new InteractiveBrowserCredentialOptions
{
    ClientId = "YOUR_CLIENT_ID",
    TenantId = "YOUR_TENANT_ID",
    RedirectUri = new Uri("http://localhost")
};
var credential = new InteractiveBrowserCredential(options);
var graphClient = new GraphServiceClient(credential, scopes);

// Example: GET /me
var result = await graphClient.Me.GetAsync();
Console.WriteLine($"User: {result?.DisplayName}");

JavaScript / TypeScript

// npm install @azure/msal-browser @microsoft/microsoft-graph-client
import { PublicClientApplication } from "@azure/msal-browser";
import { Client } from "@microsoft/microsoft-graph-client";
import { AuthCodeMSALBrowserAuthenticationProvider } from 
    "@microsoft/microsoft-graph-client/authProviders/authCodeMsalBrowser";

const msalConfig = {
    auth: {
        clientId: "YOUR_CLIENT_ID",
        authority: "https://login.microsoftonline.com/YOUR_TENANT_ID"
    }
};

const pca = new PublicClientApplication(msalConfig);
await pca.initialize();

// Delegated: Login with required scope
const loginResponse = await pca.loginPopup({
    scopes: ["Mail.ReadWrite.Shared"]
});

const authProvider = new AuthCodeMSALBrowserAuthenticationProvider(pca, {
    account: loginResponse.account,
    scopes: ["Mail.ReadWrite.Shared"],
    interactionType: "popup"
});

const graphClient = Client.initWithMiddleware({ authProvider });

// Example: GET /me
const result = await graphClient.api("/me").get();
console.log(result);

PowerShell

# Install Microsoft Graph PowerShell module
Install-Module Microsoft.Graph -Scope CurrentUser

# Delegated access - interactive sign-in
Connect-MgGraph -Scopes "Mail.ReadWrite.Shared"

# Verify connection
Get-MgContext | Select-Object Account, TenantId, Scopes

# Example: GET /me
$result = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/me"
$result | ConvertTo-Json -Depth 5


# Always disconnect when done
Disconnect-MgGraph

Python

# pip install msgraph-sdk azure-identity
from azure.identity import InteractiveBrowserCredential, ClientSecretCredential
from msgraph import GraphServiceClient
import asyncio

# Delegated permissions - interactive browser sign-in
credential = InteractiveBrowserCredential(
    client_id="YOUR_CLIENT_ID",
    tenant_id="YOUR_TENANT_ID"
)
scopes = ["Mail.ReadWrite.Shared"]
client = GraphServiceClient(credential, scopes)

async def get_data():
    # Example: GET /me
    result = await client.me.get()
    print(f"User: {result.display_name}")
    return result

asyncio.run(get_data())

App Registration

1

Navigate to Azure Portal

Go to App registrations in Microsoft Entra admin center

2

Add API Permission

Select your app → API permissions → Add a permission → Microsoft Graph

3

Select Permission Type

Choose Delegated permissions and search for Mail.ReadWrite.Shared

4

Grant Admin Consent

Users can consent to this permission themselves during sign-in.