Jira Mail Handler and Service Management Mail Handler cannot be configured using Oauth 2.0

Summary

Both types of mail handlers (Jira and Service Management) can't be configured with a Microsoft Mailbox (shared or non shared) using the Oauth 2.0 authentication:

• Configuring a Jira Service Management (JSM) Mail Handler for a Service Management project via the page Project Settings > Email Request fails while using the authorize button with the Oauth 2.0 authentication

• Configuring a Jira Mail Server in ⚙ > System > Incoming Mail fails during the Test Connection step

Environment

Jira Service Management 4.10.0 / Jira 8.10.0 and higher, integrated with Office 365 or Microsoft Exchange

Diagnosis

• An Oauth 2.0 integration was configured in ⚙ > System > Oauth 2.0, with the same scopes as the ones mentioned inIntegrating with Oauth 2.0, and the connection test was successful.

• When trying to configure a JSM Mail Handler via the page Project Settings > Email Request, the following error is thrown in the UI

  • 1 Here's the error we received: "OAuth token not defined for connection. OAuth Authorisation required."

• the following error is thrown in the Jira Incoming Mail Logs

• 1 2 3 4 5 6 2021-11-22 12:22:32,914+0100 ERROR [] https-jsse-nio-8443-exec-5 julien 742x19484x1 1nxdphq 127.0.0.1 /rest/servicedesk/1/servicedesk/admin/email/test Unable to connect to the server at outlook.office365.com due to the following exception: com.atlassian.jira.internal.mail.processor.errors.MailConnectionException: OAuth token not defined for connection. OAuth Authorisation required. at com.atlassian.jira.internal.mail.processor.feature.channel.connectionverifier.DefaultChannelConnectionVerifier.verifyConnectionDefinition(DefaultChannelConnectionVerifier.java:76) [?:?] at com.atlassian.jira.internal.mail.processor.feature.channel.connectionverifier.DefaultChannelConnectionVerifier.verifyConnectionDefinition(DefaultChannelConnectionVerifier.java:58) [?:?] at jdk.internal.reflect.GeneratedMethodAccessor3792.invoke(Unknown Source) [?:?] at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) [?:?]

Note that when trying to configure the same mailbox in Project Settings > Email Requests, but this time with Basic Authentication (using the mailbox password), a different error is thrown:

• When trying to configure a Jira Mail Server with Oauth 2.0 in ⚙ > System > Incoming Mails

  • Clicking on the Authorize button leads to a successful result ("Authorization has successfully completed.")

  • Clicking on the Test Connection button leads to an error thrown in the UI:

    1 2 Unfortunately no connection was possible. Review the errors below and rectify: • AuthenticationFailedException: AUTHENTICATE failed.

• The following error is thrown in the Jira logs

• When logging directly into the mailbox in Microsoft Outlook (https://outlook.office.com/mail/inbox), the following error is thrown in the UI:

  • Error:

    1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 UTC Date: 2021-12-08T09:50:21.069Z BootResult: configuration Client Id: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Session Id: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXX Client Version: 20211129004.15 err: Microsoft.Exchange.Clients.Owa2.Server.Core.OwaUserHasNoMailboxAndNoLicenseAssignedException esrc: StartupData et: ServerError estack: Error: 500 at i (https://outlook.office.com/mail/inbox/:363:209906) at https://outlook.office.com/mail/inbox/:363:147412 st: 500 ehk: X-OWA-Error efe: CY4PR16CA0042, AS8P250CA0011 ebe: CY4PR10MB1639 emsg: UserHasNoMailboxAndNoLicenseAssignedError

Cause

There is no license provided for the Microsoft account to access the mailbox that belongs to this account.

Solution

Reach out to your Microsoft Administration team to grant the account a license allowing to access the mailbox.

One way to grant a license to the account is to go to the Azure Admin portal, as explained in Assign or remove licenses in the Azure Active Directory portal. Basically, what your admin user can do is:

• Log into https://portal.azure.com/ as an Admin user

• Go to Users and click on the account that needs a license

• After that, click on Licenses > Assignments.