Updating a grant with fewer scopes (remove access to shared mailboxes)

Question and Answers
1

I’m using the API calling PATCH grant/ with fewer scopes (specifically removing MS Mail.Read.Shared) in the body than the grant already has. I’m receiving a 200 response and the returned grant object has all of the original scopes in it.

The user is then logging in again with the scopes set without Mail.Read.Shared, however they still have access to the shared mailbox.

My understanding is the update call should replace the grant’s existing scopes with those in the call and stop access to shared mailboxes. Have I misunderstood or is something going wrong?

2

Hi ChrisIkiru,

Thanks for reaching out about this. You’ve correctly identified an important distinction in how the PATCH /v3/grants/{grantId} endpoint works.

The PATCH /v3/grants/{grantId} endpoint updates Nylas’ stored scope metadata, but doesn’t change the actual permissions at the provider level. Microsoft still holds the original refresh token with Mail.Read.Shared included.

To actually remove shared mailbox access, the user must re-authenticate through the OAuth flow with the reduced scope set. This forces Microsoft to issue a new refresh token without Mail.Read.Shared.

Next steps:

  1. Update your connector to exclude Mail.Read.Shared
  2. Have the user re-authenticate via /v3/connect/auth
  3. Microsoft will consent to the reduced permissions

See: Update a grant

Let me know if you have any other questions.

Best,
Pracheta Munje

3

Hi @Pracheta thanks for your reply.

Is it correct that when I update a grant with a new scope list, I get the original scopes back?

The user is authenticating with v3/connect/auth after I have attempted to update the grant’s scope list and including the new reduced scope list as a query parameter. There is no new MS consent screen

4

Hello,

The behavior you’re seeing is not supported. Scopes are controlled at the connector level, not at the individual grant level. While the API accepts a PATCH request to update a grant’s scope, this only updates the scope metadata stored by Nylas—it doesn’t change the actual permissions at the provider.

See: Update a grant

To remove Mail.Read.Shared access, you’ll need to update your connector’s scope configuration, then have the user re-authenticate through the OAuth flow.

Many thanks,

Pracheta Munje.

Support Engineer, Nylas