Microsoft EWS api GetItem (mail) response ErrorInvalidUserPrincipalName but principal name is correct

Question

I used Microsoft EWS api GetItem to get mail message item, but for certain users, server response ErrorInvalidUserPrincipalName (other users are work without errors), and I check principal name is correct with Microsoft Graph api.

<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages">
    <soap:Header>
        <t:RequestServerVersion Version="Exchange2013"/>
        <t:ExchangeImpersonation>
            <t:ConnectingSID>
                <t:PrincipalName>[email protected]</t:PrincipalName>
            </t:ConnectingSID>
        </t:ExchangeImpersonation>
    </soap:Header>
    <soap:Body>
        <m:GetItem>
            <m:ItemShape>
                <t:BaseShape>IdOnly</t:BaseShape>
                <t:IncludeMimeContent>true</t:IncludeMimeContent>
            </m:ItemShape>
            <m:ItemIds>
                <t:ItemId Id="xxx"/>
            </m:ItemIds>
        </m:GetItem>
    </soap:Body>
</soap:Envelope>

And server response ErrorInvalidUserPrincipalName.

<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
    <s:Body>
        <s:Fault>
            <faultcode xmlns:a="http://schemas.microsoft.com/exchange/services/2006/types">a:ErrorInvalidUserPrincipalName</faultcode>
            <faultstring xml:lang="en-US">The impersonation principal name is invalid.</faultstring>
            <detail>
                <e:ResponseCode xmlns:e="http://schemas.microsoft.com/exchange/services/2006/errors">ErrorInvalidUserPrincipalName</e:ResponseCode>
                <e:Message xmlns:e="http://schemas.microsoft.com/exchange/services/2006/errors">The impersonation principal name is invalid.</e:Message>
            </detail>
        </s:Fault>
    </s:Body>
</s:Envelope>

I used Microsoft Graph user api to check principal name, the principal name is same as I bring in EWS GetItem request but still get ErrorInvalidUserPrincipalName response.

 {
"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users/$entity",
"id": "zzz",
"businessPhones": [],
"displayName": "yyy",
"mail": "[email protected]",
"userPrincipalName": "[email protected]"
...
}

I tried to send same EWS GetItem with PrimarySmtpAddress tag rather than PrincipalName (smtp address is same as principal name), and it works without error, I don't know why use PrincipalName will get ErrorInvalidUserPrincipalName response even principal name looks correct.

<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages">
    <soap:Header>
        <t:RequestServerVersion Version="Exchange2013"/>
        <t:ExchangeImpersonation>
            <t:ConnectingSID>
               <t:PrimarySmtpAddress>[email protected]</t:PrimarySmtpAddress>
            </t:ConnectingSID>
        </t:ExchangeImpersonation>
    </soap:Header>
    <soap:Body>
        <m:GetItem>
            <m:ItemShape>
                <t:BaseShape>IdOnly</t:BaseShape>
                <t:IncludeMimeContent>true</t:IncludeMimeContent>
            </m:ItemShape>
            <m:ItemIds>
                <t:ItemId Id="xxx"/>
            </m:ItemIds>
        </m:GetItem>
    </soap:Body>
</soap:Envelope>

Is anyone occur same problem and can help me to solve this?

Thanks!

Answer 1

After use PowerShell check, found UserPrincipalName is inconsistent on Exchange Server.

Get-Mailbox | Select-Object -ExpandProperty UserPrincipalName

Output: [email protected]

But Graph api return UserPrincipalName is [email protected]

Then contact Microsoft support, they help to set UserPrincipalName consistent, after UserPrincipalName consistent, EWS api GetItem can work perfectly with PrincipalName.

Thanks.

Answer 2

Does the Mailbox have a valid licence (the EXCHANGEDESKLESS Exchange Online Kiosk licence also doesn't have EWS access) and is it enabled and has been logged on to at least once. Typically when you get this error its because your trying to impersonate a disabled account.