I'm trying to setup an azure function to monitor a shared MS3655 inbox for emails.

I have granted MS Graph Mail.Read permissions to the function's ManagedIdentity in Entra ID. I verified this by decoding the generated JWT and checking that the role is included correctly.

var credential = new ManagedIdentityCredential(ManagedIdentityId.SystemAssigned);
var token = await credential.GetTokenAsync(
                new TokenRequestContext(new[] { "https://graph.microsoft.com/.default" }));

I created an Application Access Policy to restrict the App to only read the designated inbox.

The inbox is a properly provisioned mailbox with MS365 Business Basic license. We can send & receive emails from it using our personal business accounts.

I know the JWT is valid because when I call the /users endpoint I get a 403 response, which is expected since no permissions were granted for reading users. But when I call /v1.0/users//mailFolders/inbox endpoint I get a 401 response with no body content.

I have tested this (using the same JWT) from my development machine to see if there was a network-related issue, but I get the same response.

I tried to log a support ticket but they redirected me to Community Q&A, but then my question was deleted. So now I'm here.

Does anyone have some insight into why MS graph would return an empty 401 response when requesting mailbox data?