title: Access Denied in UpdateItem with Exchange EWS when called from Outlook JavaScript Api (office.js)
body: <p>We develop an Outlook Add-In using the office JavaScript api and need to Update a category for a mail message.</p>
  
  <p>When trying to call UpdateItem with Exchange EWS, using the add-in token - it fails with 500.</p>
  
  <p>See request and response at: <a href="http://pastebin.com/55x2d2Ht" rel="nofollow noreferrer">http://pastebin.com/55x2d2Ht</a></p>
  
  <ol>
  <li>The app's manifest permissions is ReadWriteMailbox (highest)</li>
  <li>When the app is selected in OWA /manageapps - it displays "When this adding is clicked, it will be able to: Read, create and update email in your mailbox"</li>
  <li>Tried both token from mailbox.getCallbackTokenAsync and using makeEwsRequestAsync.</li>
  <li>EWS GetItem and CreateItem operations succeeds - it is only UpdateItem that is failing</li>
  <li>Response to UpdateItem: 500 The requested web method is unavailable to this caller or application.</li>
  <li>The fact that it is 500 (and not 403) may imply that the UpdateItem operation is blocked for addin app altogether</li>
  <li>The jwt token (from getCallbackTokenAsync) doesn't have 'scp' key</li>
  <li>If the same UpdateItem XML Soap packet is sent with another token, from a test OAuth app registered in Azure with permissions Read/Write to Exchange --> it succeeds. This app jwt token with "scp": "full_access_as_user Mail.Read Mail.ReadWrite Mail.Send"</li>
  <li>Tried with another exchange user with the add-in token - also fails.</li>
  <li>Office AddIn docs states that EWS UpdateItem operation is supported in the context of addin. See <a href="https://dev.office.com/docs/add-ins/outlook/web-services" rel="nofollow noreferrer">Office Dev Center</a></li>
  <li>Summary: Only Ews UpdateItem with the Addin OAuth token fails. Other operations succeeds and Posting UpdateItem using other tokens (or Basic Auth) also succeeds.</li>
  </ol>