How to Decrypt Outlook 365 S/MIME Emails in Java Using Microsoft Graph API

import jakarta.mail.Session;
import jakarta.mail.internet.MimeMessage;
import jakarta.mail.internet.MimeMultipart;
import jakarta.mail.BodyPart;

import org.bouncycastle.cms.;
import org.bouncycastle.cms.jcajce.;
import org.bouncycastle.jce.provider.BouncyCastleProvider;

import java.io.;
import java.net.URI;
import java.net.http.;
import java.nio.charset.StandardCharsets;
import java.security.;
import java.security.cert.X509Certificate;
import java.util.Properties;

public class GraphSmimeDecryptor {

    static {
        Security.addProvider(new BouncyCastleProvider());
    }

    public static void main(String[] args) throws Exception {
        String accessToken = System.getenv("GRAPH_ACCESS_TOKEN");
        String userId = "me"; // or a user GUID/email for /users/{id}
        String messageId = System.getenv("GRAPH_MESSAGE_ID");

        // 1) Download raw MIME from Microsoft Graph
        byte[] rawMime = downloadMessageMime(accessToken, userId, messageId);

        // 2) Parse the MIME so we can locate the S/MIME encrypted part
        MimeMessage outer = parseMime(rawMime);

        // 3) Extract CMS/PKCS7 bytes from the message (simple/common S/MIME layout)
        byte[] pkcs7 = extractPkcs7Payload(outer);
        if (pkcs7 == null) {
            throw new IllegalStateException("No S/MIME PKCS#7 payload found. Message may be unencrypted or uses a different layout.");
        }

        // 4) Load recipient private key + certificate used for S/MIME decryption
        KeyMaterial km = loadPkcs12("recipient-keystore.p12", "p12Password".toCharArray());

        // 5) Decrypt CMS envelope => yields inner (plaintext) MIME bytes
        byte[] innerMimeBytes = decryptCmsEnvelopedData(pkcs7, km.certificate, km.privateKey);

        // 6) Parse decrypted MIME and print a readable body
        MimeMessage inner = parseMime(innerMimeBytes);
        String bodyText = extractBestEffortBodyText(inner);

        System.out.println("=== Decrypted Subject ===");
        System.out.println(inner.getSubject());
        System.out.println("
=== Decrypted Body (best effort) ===");
        System.out.println(bodyText);
    }

    // ---------------- Graph download ----------------

    static byte[] downloadMessageMime(String accessToken, String userId, String messageId) throws Exception {
        String url = "https://graph.microsoft.com/v1.0/" +
                (userId.equals("me") ? "me" : "users/" + userId) +
                "/messages/" + messageId + "/$value";

        HttpClient client = HttpClient.newHttpClient();
        HttpRequest req = HttpRequest.newBuilder()
                .uri(URI.create(url))
                .header("Authorization", "Bearer " + accessToken)
                .header("Accept", "application/octet-stream")
                .GET()
                .build();

        HttpResponse<byte[]> resp = client.send(req, HttpResponse.BodyHandlers.ofByteArray());
        if (resp.statusCode() != 200) {
            String msg = new String(resp.body(), StandardCharsets.UTF_8);
            throw new IOException("Graph returned " + resp.statusCode() + ": " + msg);
        }
        return resp.body();
    }

    // ---------------- MIME parsing ----------------

    static MimeMessage parseMime(byte[] raw) throws Exception {
        Session session = Session.getInstance(new Properties());
        try (InputStream is = new ByteArrayInputStream(raw)) {
            return new MimeMessage(session, is);
        }
    }

    /**
      Common S/MIME encrypted messages look like:
      Content-Type: application/pkcs7-mime; smime-type=enveloped-data; name=smime.p7m
      This method tries a few typical places to find that blob.
     /
    static byte[] extractPkcs7Payload(MimeMessage msg) throws Exception {
        Object content = msg.getContent();

        // Case A: the whole message content is already the pkcs7 part
        String ct = msg.getContentType().toLowerCase();
        if (ct.contains("application/pkcs7-mime") || ct.contains("application/x-pkcs7-mime")) {
            return readAllBytes(msg.getInputStream());
        }

        // Case B: multipart wrapper where one part is pkcs7
        if (content instanceof MimeMultipart mm) {
            for (int i = 0; i < mm.getCount(); i++) {
                BodyPart bp = mm.getBodyPart(i);
                String pct = bp.getContentType().toLowerCase();
                if (pct.contains("application/pkcs7-mime") || pct.contains("application/x-pkcs7-mime")) {
                    try (InputStream is = bp.getInputStream()) {
                        return readAllBytes(is);
                    }
                }
            }
        }

        return null;
    }

    static byte[] readAllBytes(InputStream is) throws IOException {
        ByteArrayOutputStream bos = new ByteArrayOutputStream();
        byte[] buf = new byte[8192];
        int r;
        while ((r = is.read(buf)) != -1) {
            bos.write(buf, 0, r);
        }
        return bos.toByteArray();
    }

    // ---------------- Key loading ----------------

    static class KeyMaterial {
        final X509Certificate certificate;
        final PrivateKey privateKey;
        KeyMaterial(X509Certificate cert, PrivateKey pk) { this.certificate = cert; this.privateKey = pk; }
    }

    static KeyMaterial loadPkcs12(String p12Path, char[] password) throws Exception {
        KeyStore ks = KeyStore.getInstance("PKCS12");
        try (InputStream is = new FileInputStream(p12Path)) {
            ks.load(is, password);
        }

        String alias = ks.aliases().nextElement();
        PrivateKey privateKey = (PrivateKey) ks.getKey(alias, password);
        X509Certificate cert = (X509Certificate) ks.getCertificate(alias);

        if (privateKey == null || cert == null) {
            throw new IllegalStateException("Could not load key material from PKCS#12 keystore.");
        }
        return new KeyMaterial(cert, privateKey);
    }

    // ---------------- CMS decrypt ----------------

    static byte[] decryptCmsEnvelopedData(byte[] pkcs7, X509Certificate recipientCert, PrivateKey recipientKey) throws Exception {
        CMSEnvelopedData enveloped = new CMSEnvelopedData(pkcs7);

        RecipientInformationStore recipients = enveloped.getRecipientInfos();
        RecipientId rid = new JceKeyTransRecipientId(recipientCert);

        RecipientInformation recipient = recipients.get(rid);
        if (recipient == null) {
            // If cert matching fails, fall back to first recipient as a last resort
            recipient = recipients.getRecipients().stream().findFirst().orElse(null);
        }
        if (recipient == null) {
            throw new IllegalStateException("No recipients found in CMS envelope.");
        }

        JceKeyTransEnvelopedRecipient r = new JceKeyTransEnvelopedRecipient(recipientKey).setProvider("BC");
        return recipient.getContent(r);
    }

    // ---------------- Body extraction ----------------

    static String extractBestEffortBodyText(MimeMessage msg) throws Exception {
        Object content = msg.getContent();
        if (content instanceof String s) return s;

        if (content instanceof MimeMultipart mm) {
            // Prefer text/plain if present; otherwise fall back to first text/
            String fallback = null;
            for (int i = 0; i < mm.getCount(); i++) {
                BodyPart bp = mm.getBodyPart(i);
                String ct = bp.getContentType().toLowerCase();
                if (ct.startsWith("text/plain")) return (String) bp.getContent();
                if (fallback == null && ct.startsWith("text/")) fallback = (String) bp.getContent();
            }
            if (fallback != null) return fallback;
        }
        return "[No readable text body found]";
    }
}

Read more at : How to Decrypt Outlook 365 S/MIME Emails in Java Using Microsoft Graph API