Access denied to add Microsoft Graph Schema Extension on a Message - microsoft-graph-api

Question

We're curretly making a multi-tenant app where admin users can log on Office365 and manipulate other users' emails. We want to add a schema extension on created Message, but I end up with a AccessDenied error.
Note that I use the arxone_path schema extension, that is Available (you can try to use it).
I first set up the delegated permission Mail.ReadWrite on my app registration on Azure (like said on https://learn.microsoft.com/en-us/graph/api/opentypeextension-post-opentypeextension?view=graph-rest-1.0#permissions ). I also added Mail.ReadWrite.Shared permission. Using the user's access token, I can actually fetch, create, delete or update Message of another user. But if I try to update a message to add a schema extension like this:
PATCH https://graph.microsoft.com/v1.0/{{user}}/messages/{{message}}
Content-Type: application/json
{
"arxone_path": {
"path":"some/path"
}
}
I always get this response :
HTTP/1.1 403 Forbidden
Content-type: application/json
{
"error": {
"code": "ErrorAccessDenied",
"message": "Access is denied. Check credentials and try again.",
"innerError": {
"request-id": "a95b0641-63e9-4601-82f2-d8c4ed6d64d8",
"date": "2020-01-16T16:12:29"
}
}
}
To sum up, I can:
Edit one of the connected user's own message -> OK
Add extension of the connected user's own message -> OK
Edit another user message -> OK
Add extension of another user message -> NOT OK

Answer 1

You cannot add an Open Extension to a users objects using delegated access token for another user. You would need to have that user sign in and use their delegated access token.
The other approach is to use application permissions (app-only) and request User.ReadWrite.All which will require Admin Consent by an Administrator.

Answer 2

I believe this url says you may need additional permissions (depending on the account type) when trying to create an open Extension.
Delegated (work or school)
User.ReadWrite.All
Delegated (personal Microsoft Account)
User.ReadWrite
Application
User.ReadWrite.All