title: Authenticate user to Exchange online with Outlook online token from an add-in
body: <h1>Update</h1>
  
  <p>It seems that the <a href="https://dev.outlook.com/reference/add-ins/Office.context.mailbox.html#getUserIdentityTokenAsync" rel="nofollow"><strong>UserIdentityToken</strong></a> is not usable for identifying the user to Exchange Online. That token can be use by a third-party service (i.e. a custom chat account) for a reliable way to identify the current user.</p>
  
  <p>We can rely on the <strong>callback token</strong> if we want to retrieve something from Exchange Online but there is a <strong>5 minutes time limit</strong>.</p>
  
  <p>If we absolutely want to avoid this limit, the only other way that I found is to ask for their Office 365 credentials. Here is how I do it :</p>
  
  <h2>JS</h2>
  
  <pre><code>// Send Basket Button | Send the basket to Sharepoint
  $("#sendMails").click(function () {
      var mailsId = getMailIds();
      if (mailsId != null) saveMails(mailsId);
  });
  
  function saveMails(mailsId) {
      $.post(
          "/AJAX/SaveMails"
          {
              mailsId: JSON.stringify(mailsId),
              login: "mymail@onmicrosoft.com",
              password: "mypass",
          },
          function(result) {
              console.log("saveMails : ", result);
          },
          "text"
      );
  }
  </code></pre>
  
  <h2>C# ASP.NET MVC</h2>
  
  <pre><code>[HttpPost]
  public ActionResult SaveMails()
  {
      // Office365 credentials
      var login = Request["login"];
      var password = Request["password"];
  
      // mailsID to retrieve from Exchange
      // IDs come from Office.context.mailbox.item.itemId
      var mailsID = JsonConvert.DeserializeObject&lt;List&lt;string&gt;&gt;(Request["mailsID"]);
  
      // Set credentials and EWS url for the Exchange connection
      var exService = new ExchangeService
      {
          // User's credentials
          Credentials = new WebCredentials(login, password),
  
          // Exchange Uri (always the same for Office365)
          Url = new Uri("https://outlook.office365.com/EWS/Exchange.asmx")
      }
  
      foreach(var mail in mailsID)
      {
           var itemId = new ItemId(mail);
           // Get mails from Exchange Online
           var email = EmailMessage.Bind(exService, itemId);
  
           // ... Do something with the mail
      }
  
      // ... Rest of the code
  }
  </code></pre>
  
  <p>Now you can do what you need with your mails.</p>
  
  <hr>
  
  <p><em>(Old post)</em></p>
  
  <p>I struggle with this. I would like to retrieve a bunch of emails with my <strong>ASP.NET MVC Web Server</strong> from Outlook online without the limit of the item token that have a lifetime of only 5 minutes.</p>
  
  <p>What I'm currently trying is :</p>
  
  <ul>
  <li>Getting the <strong>UserIdentityToken</strong> with <a href="https://dev.outlook.com/reference/add-ins/Office.context.mailbox.html#getUserIdentityTokenAsync" rel="nofollow">Office.context.mailbox.getUserIdentityTokenAsync()</a> method</li>
  <li>Send the token to my web server</li>
  <li>Instanciate the ExchangeService object with this token</li>
  <li>Try to get my mails</li>
  </ul>
  
  <p>Obviously, it doesn't work. However, I tried to auth by entering the <strong>login and the password</strong> of my Office Account and here it does work.</p>
  
  <p>I read elsewhere that we have to validate our token before trying to authenticate with it but it seems to only concern external app with an Azure AD? In my case, that's just <strong>an Outlook Online WEB add-in</strong>.</p>
  
  <p>Well, here is my current code in my controller (that handle the authentication and that try to retrieve the mails from Exchange)</p>
  
  <pre><code>[HttpPost]
  public ActionResult GetMails()
  {
      // Token from getUserIdentityTokenAsync() as a string
      var token = Request["token"];
  
      // mailsID to retrieve from Exchange
      // IDs come from Office.context.mailbox.item.itemId
      var mailsID = JsonConvert.DeserializeObject&lt;List&lt;string&gt;&gt;(Request["mailsID"]);
  
  
      var exService = new ExchangeService
      {
          Url = new Uri("https://outlook.office365.com/EWS/Exchange.asmx"),
          Credentials = new OAuthCredentials(token),
  
          // WebCredentials works but I don't want the user to enter that
          // Credentials = new WebCredentials("mymail@onmicrosoft.com", "mypass");
      }
  
      foreach(var mail in mailsID)
      {
           var itemId = new ItemId(mail);
           // Try to get the mail from Exchange Online
           var email = EmailMessage.Bind(exService, itemId);
  
           // ... Rest of the code
      }
  
      // ... Rest of the method
  }
  </code></pre>
  
  <p><a href="https://dev.outlook.com/reference/add-ins/Office.context.mailbox.item.html#itemId" rel="nofollow"><em>Office.context.mailbox.item.itemId reference</em></a></p>
  
  <p>My goal is to avoid the user to enter their Office Online credentials again, it would be weird and... Insecure, I think. What I am missing, so?</p>
  
  <p>Thanks in advance.</p>