EWS GetStreamingEvents returns access error - exchangewebservices

Question

I am using a event notification subscription to get notified about new mail, etc. For one of our customers I get strange errors that I can't explain or fix.
The error is:
Access is denied. Only the subscription owner may access the subscription.
According the documentation this error is generated when the authenticated user for the subscription is different than the user for the GetEvents request. In my case the authorization header for both requests is exactly the same. Also I checked the subscription id to be the same.
The server is outlook.office365.com. This only happens on the email account for the customer. On our own email account it is all fine.
Can anybody shed some light on this? Thx.
This is the subscription request (all xmlns attributes have been removed):
EwsRequest:
<Trace Tag="EwsRequest" Tid="53" Time="2020-10-24 22:00:52Z" Version="2.2.1.0">
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope>
<soap:Header>
<t:RequestServerVersion Version="Exchange2016" />
</soap:Header>
<soap:Body>
<m:Subscribe>
<m:StreamingSubscriptionRequest>
<t:FolderIds>
<t:DistinguishedFolderId Id="inbox">
<t:Mailbox>
<t:EmailAddress>webreg#ds.dk</t:EmailAddress>
</t:Mailbox>
</t:DistinguishedFolderId>
</t:FolderIds>
<t:EventTypes>
<t:EventType>NewMailEvent</t:EventType>
<t:EventType>DeletedEvent</t:EventType>
<t:EventType>ModifiedEvent</t:EventType>
<t:EventType>MovedEvent</t:EventType>
</t:EventTypes>
</m:StreamingSubscriptionRequest>
</m:Subscribe>
</soap:Body>
</soap:Envelope>
</Trace>
and this is the response:
EwsResponse:
<Trace Tag="EwsResponse" Tid="53" Time="2020-10-24 22:00:52Z" Version="2.2.1.0">
<?xml version="1.0" encoding="utf-8"?>
<s:Envelope >
<s:Header>
<h:ServerVersionInfo MajorVersion="15" MinorVersion="20" MajorBuildNumber="3499" MinorBuildNumber="18" Version="V2018_01_08" />
</s:Header>
<s:Body>
<m:SubscribeResponse >
<m:ResponseMessages>
<m:SubscribeResponseMessage ResponseClass="Success">
<m:ResponseCode>NoError</m:ResponseCode>
<m:SubscriptionId>JwBhbTdwcjA3bWI2NjI4LmV1cnByZDA3LnByb2Qub3V0bG9vay5jb20QAAAARQChc1Q/8EqY5NixfPmIikK4REZoeNgIEAAAAKQK6CUVOJlGvS0wpw59GqM=</m:SubscriptionId>
</m:SubscribeResponseMessage>
</m:ResponseMessages>
</m:SubscribeResponse>
</s:Body>
</s:Envelope>
</Trace>
This is the GetStreamingEvents request:
EwsRequest:
<Trace Tag="EwsRequest" Tid="53" Time="2020-10-24 22:00:52Z" Version="2.2.1.0">
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope >
<soap:Header>
<t:RequestServerVersion Version="Exchange2016" />
</soap:Header>
<soap:Body>
<m:GetStreamingEvents>
<m:SubscriptionIds>
<t:SubscriptionId>JwBhbTdwcjA3bWI2NjI4LmV1cnByZDA3LnByb2Qub3V0bG9vay5jb20QAAAARQChc1Q/8EqY5NixfPmIikK4REZoeNgIEAAAAKQK6CUVOJlGvS0wpw59GqM=</t:SubscriptionId>
</m:SubscriptionIds>
<m:ConnectionTimeout>30</m:ConnectionTimeout>
</m:GetStreamingEvents>
</soap:Body>
</soap:Envelope>
</Trace>
and this is the response:
EwsResponse:
<Trace Tag="EwsResponse" Tid="13" Time="2020-10-24 22:00:52Z" Version="2.2.1.0">
<Envelope>
<soap11:Header >
<ServerVersionInfo MajorVersion="15" MinorVersion="20" MajorBuildNumber="3499" MinorBuildNumber="18" Version="V2018_01_08" />
</soap11:Header>
<soap11:Body >
<m:GetStreamingEventsResponse >
<m:ResponseMessages>
<m:GetStreamingEventsResponseMessage ResponseClass="Error">
<m:MessageText>Access is denied. Only the subscription owner may access the subscription.</m:MessageText>
<m:ResponseCode>ErrorSubscriptionAccessDenied</m:ResponseCode>
<m:DescriptiveLinkKey>0</m:DescriptiveLinkKey>
<m:ErrorSubscriptionIds>
<m:SubscriptionId>JwBhbTdwcjA3bWI2NjI4LmV1cnByZDA3LnByb2Qub3V0bG9vay5jb20QAAAARQChc1Q/8EqY5NixfPmIikK4REZoeNgIEAAAAKQK6CUVOJlGvS0wpw59GqM=</m:SubscriptionId>
</m:ErrorSubscriptionIds>
</m:GetStreamingEventsResponseMessage>
</m:ResponseMessages>
</m:GetStreamingEventsResponse>
</soap11:Body>
</Envelope>
</Trace>

Answer 1

Ok I ran into this error that I finally managed to track down. Basically it's a bit of a misleading error from Exchange.
The actual error (at least in my case) was that the number of pull subscriptions for the service account we were using to connect to exchange had been reached. Microsoft's documentation on throttling. Basically per account 20 open subscriptions. It seems when you reach this limit, the subscription will still be created, but either gets created somehow under a different user, or it is immediately killed. Exchange then returns that ErrorSubscriptionAccessDenied error.
The solution that fixes the issue seems to be to use the service account and set the ImpersonatedUserId on the ExchangeService to the user that you are actually subscribing to. That way the subscription count goes against the individual user instead. We also had to set the ExchangeService to have an X-AnchorMailbox header with the impersonated user's SMTP address.
Hopefully this helps someone else from going insane.