SMTP.Send Consent Flow with Daemon Service – Handling Token Refresh

Hi Ranjith Kumar Sekar

Is there any update from you?

If yes, please feel free to let us know.

Hi @Gabriel-N

Thanks for answering.
I understand that you’re suggesting the On-Behalf-Of (OBO) flow. How is the user principal actually passed to the backend if I’m using MSAL.js for frontend login? Also, is it possible to use this flow for a longer duration without requiring user interaction?

Hi Ranjith Kumar Sekar

For your two questions, I’ve done some research that might help. But here’s what I found regarding the OBO Flow with MSAL.js for Frontend Login:

Frontend (Angular/MSAL.js):

• The user logs in interactively (e.g., loginPopup).
• Requests backend scope (e.g., api://backend-app-id/user_impersonation) plus offline_access.
• Receives an access token (JWT with user claims like oid) and a refresh token.

Pass to Backend:

• Only the access token is sent securely via HTTPS to the .NET API.

Backend OBO:

• MSAL.NET uses AcquireTokenOnBehalfOf with the access token as a user assertion.
• Exchanges it for a Graph token (e.g., scope: Mail.Send).
• This preserves the user’s identity via claims.

Using OBO for Long Duration Without User Interaction:

• Backend Caching: MSAL.NET caches Graph access/refresh tokens and silently refreshes access tokens using the refresh token.
• Duration: Refresh tokens typically last ~90 days of inactivity (configurable via Entra ID policies).
• Daemon Operations: Backend can use AcquireTokenSilent for ongoing tasks like email sending without user prompts.
• Limits: Tokens are revoked on sign-out or password change, so it’s important to monitor errors and plan for re-authentication if needed.

This setup is ideal for daemons due to secure backend handling.

Hi @Gabriel-N
Thanks for continued support.
I’m still a bit unsure about the correct authority URI and scopes required to acquire the SMTP.Send permission. Could you please suggest the right authority URI and scopes that should be used in both the frontend and backend for generating and rotating the token?

Hi Ranjith Kumar Sekar

Based on my research, I believe the following information is what you might be looking for. Please note that this is based on theoretical understanding and documentation review. For more accurate or in-depth technical assistance, I recommend raising a support ticket with Microsoft or posting your question on Microsoft Tech Community.

Authority URI (for both frontend and backend)

https://login.microsoftonline.com/{tenant-id}/v2.0

Replace {tenant-id} with your Entra ID tenant GUID or domain (for example, contoso.onmicrosoft.com). The v2.0 endpoint is required for modern OAuth flows and delegated permissions such as SMTP.Send.

Frontend (MSAL.js in Angular)

• Authority: same as above
• Scopes:

['api://your-backend-client-id/user_impersonation', 'offline_access']

user_impersonation is the custom scope for your backend API, and offline_access enables refresh tokens for silent token renewal.

Backend (.NET with MSAL.NET)

• Authority: same as above
• Scopes for On-Behalf-Of (OBO) exchange:

["https://outlook.office.com/SMTP.Send"]

This scope allows sending emails via SMTP on behalf of the signed-in user.

Additional Notes

• The frontend should not request SMTP.Send directly; it only requests the backend API scope.
• The backend uses the OBO flow to exchange the frontend token for an SMTP token.
• Include offline_access in the frontend scopes to allow token refresh without user interaction.
• For new applications, Microsoft recommends using Microsoft Graph Mail.Send instead of SMTP, as SMTP AUTH is considered legacy.

You may also find this document helpful for additional insight: Tutorial: Authenticate Users End-to-End - Azure App Service | Microsoft Learn