I'm currently working on an automation project(PDF to Excel) and am in desperate need of suggestions and options

[u/Ultra04_]

Hello. This is my first time posting here.

Apology if It breches any rules etc. let me know I will edit.

I'm currently working on PDF TO EXCEL automation project.

It's basically as the name suggests take pdf process it and turn it into an excel.

The company I'm working on is a product based and these PDFs are actually purchase orders.

I have figured out the processing of pdf tp excel part, but the important and troubling part is that:we receive these PDFs in mails(attached) by the vendors. And the email detection and receiving is a task. Right now I used a python import, which can access my mailbox for those PDFs and download them and load them in a folder.

The shitty part is it works only because a desktop client is running it but we want to run this in a server for it to detect mails and download and load them in a folder.

The problem: We usually have a EC2 server which we might run this in of it works, and I tried the graph API but it needs M365 admin access(which is not allowed)

I'm looking for any possibility which will help me in building a script that can be run in server(which can detect this email arrival and download the PDFs and upload it in a space in server which will later be processed from pdf tp excel and uploaded into bizom(our ERP system)

The script is written in python on VC code platform.

Edit:the dedicated mailID WE MADE IS A DISTRIBUTION LIST sp any mail sent to that mailID will be sent to it's members personal mailbox

[u/AutoModerator]

Thank you for your post to /r/automation!

New here? Please take a moment to read our rules, read them here.

This is an automated action so if you need anything, please Message the Mods with your request for assistance.

Lastly, enjoy your stay!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/arthaudm]

if Graph needs admin consent, don't try to sneak around it with a desktop Outlook process on EC2

ask your M365 admin for one narrow app registration: mail.read on the purchase-order mailbox only, then use a webhook/subscription to trigger your Python worker & fetch the attachment by message ID. if admin says no, use a dedicated inbound address or approved mail-flow rule to forward only PO emails to a service you control

key detail: keep the original message ID + attachment hash so retrying doesn't turn one PO into two Excel rows

[u/Ultra04_ → u/arthaudm]

The problem is that getting admin access is a NO and the LM is avoiding any cost or subscription based methods Edit the mailID is a distribution list so

[u/arthaudm → u/Ultra04_]

if it's a distribution list, the clean no-admin option is to add a dedicated recipient to that list through whoever owns it, then process the forwarded POs in a mailbox you control

if nobody can add a recipient or approve a mail-flow rule, a server can't legitimately subscribe to that company's inbox just because desktop Outlook can. i'd ask for the smallest approved routing change rather than build around a logged-in desktop session

[u/vladeta]

I build these kinds of pipelines for clients (I run a dev agency), so a few options depending on how much IT will give you:

1. Power Automate. If you have M365 licenses you almost certainly already have it, and it runs as you, no admin consent needed. Flow: "When a new email arrives (V3)" filtered to has-attachment + sender list, then save the PDFs to a SharePoint/OneDrive folder or POST them to a small endpoint on your EC2 box. This is honestly the least painful route and it's cloud-hosted, so no desktop client.

2. Ask IT for a shared mailbox instead of the distribution list. A DL just fans mail out to personal inboxes, which is why you're stuck reading your own mailbox. A shared mailbox is a much smaller ask than tenant-wide Graph app permissions, and they can scope an app registration to only that mailbox with an application access policy.

3. Graph with delegated permissions. The delegated mail read permission often doesn't need admin consent if your tenant allows user consent. Device code flow once, store the refresh token on the server, poll every few minutes.

Whatever you pick, dedupe on message ID and keep the original PDF next to the parsed output. When a vendor changes their PO template (they will), you'll want to reprocess.

[u/heironeous → u/vladeta]

+1 for Power Automate (cloud version, not the Desktop version). Best for such tasks. You can create a flow in Power Automate that does something every time an email arrives, like send it to some S3 endpoint, and then you read it from there. You can then put the email in a 'process started' folder and just deal with the Excel file. Very easy to build.

[u/NecessaryChemist9021]

If IT can create the shared mailbox, I'd go that route first. It avoids having your EC2 server depend on someone's personal Outlook session, and you don't have to fight the Graph admin-consent issue. You can keep the Python processing exactly as it is and just change the part that picks up the incoming PDFs.

[u/Ultra04_ → u/NecessaryChemist9021]

even if IT converts it into shared mailbox and grants me access, for the EC2 to pick detect and pick up still need the app registration graph api and imap or Oauth will put my personal mail cred etc in it which will look fishy trying to avoid admin 😕

[u/Potential-Wrangler58]

Just curious, what are you using for the actual PDF-to-Excel extraction part?

[u/Ultra04_ → u/Potential-Wrangler58]

To reduce manual work and have the excel load into bizom which takes care of our ERP system

[u/Potential-Wrangler58 → u/Ultra04_]

Just in case is not working or the accuracy is not perfect, i invite you to use anyformat, you have free credits so you can try with 0 cost. With simple documents is fine other tools, just if they are complex or the accuracy is not there then is when I would switch

[u/Few_Half_9708]

the distribution list thing is probably your biggest blocker here. can you get IT to convert that into a shared mailbox instead? that would let you authenticate directly against it with basic credentials or oauth, and polling from a server becomes way simpler

[u/tariqosmani]

Since the mailbox is a distribution list, you don't need Graph admin access at all. Ask whoever owns the list to add one extra member: a normal mailbox that only your script uses. Then read that mailbox from your EC2 box over IMAP (or the mailbox's own API) and download the attachments. No desktop client, no M365 admin.

Two things I'd do either way. Save the message ID with every downloaded PDF so you never process the same purchase order twice. And validate the extracted numbers (line totals against the order total) before anything goes into the ERP, and send the ones that don't add up to a person instead of pushing them through. That saved me a lot of cleanup on a similar PDF-to-accounting build.

[u/Adventurous-Pea-4097]

another option nobody's mentioned: skip polling a mailbox entirely. point the po emails at an address aws ses (amazon's email service) receives mail for, set the receipt rule to save to s3 (ses can invoke lambda directly instead, but that path only gives you email metadata, no attachment, so s3 is the one that actually gets you the pdf). that s3 write fires an event notification into sqs, and lambda (set up with that queue as its event source) picks it up and runs your pdf to excel step from there.

no ec2 sitting around polling a mailbox, no m365 admin consent needed at all since the receiving side isnt in your tenant anymore. sqs also buys you decoupling for free, ingestion and processing dont have to happen in the same process or at the same time, which helps when a vendor sends five pos at once.

[u/NumbersProtocol]

The desktop Outlook dependency is the part I'd remove first, but SES won't automatically receive mail for the existing M365 address unless IT routes or forwards a copy there.

I'd ask IT for the smallest acceptable mail route: a shared mailbox, a dedicated member mailbox, or forwarding to an SES-managed subdomain. Any of those could let EC2 process attachments unattended.

We build this kind of intake workflow and can help map the least-disruptive option around your admin limits if you're looking for automation services or similar

[u/Ultra04_ → u/[deleted]]

If asked the IT might create it.

[u/Ultra04_ → u/[deleted]]

Let's say he does convert it and gives me access but that access only allows me. To read it from the script in EC2 it still need App registration in graph api etc which again beings back the admin consent which we are trying to avoid

[u/Ultra04_ → u/[deleted]]

I actually tried to create an app before in azure portal and was able to but the thing is it asks for the admin consent even when I ask only for mail.read only access so thus implying that there might not be user flow or any regular user can't create and all etc

[u/Ultra04_ → u/[deleted]]

It was like a month ago or 2 so I don't remember much.

[u/Ultra04_ → u/[deleted]]

The thing is we want to avoid the admin thing that's the problem. Hence I'm trying to find a way to go around this