> For the complete documentation index, see [llms.txt](https://help.solar-archive.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.solar-archive.com/docs/msp-onboarding-guide/m365-onboarding/microsoft-entra-oauth.md).

# Microsoft Entra OAuth

[Quickstart: Register an app in the Microsoft identity platform - Microsoft identity platform](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app?tabs=certificate)

## **Create an App Registration in Entra**

1. Log in to the Entra Portal using Global Admin credentials.
2. In the Entra Portal (entra.microsoft.com) go to **Identity > Applications > App registrations > New Registration.**

   <figure><img src="/files/JqtrHyoEBgwRCe4pCUkN" alt=""><figcaption></figcaption></figure>
3. Provide the following details:
   * **Name**: "YOUR ARCHIVE."
   * **Supported Account Types**: Choose **Accounts in this organizational directory only**.
   * **Redirect URI**: Use the URI provided by YOUR ARCHIVE (`Advanced Configuration -> SSO-OAuth -> Create Connection`) and select Web in the dropdown.

     <figure><img src="/files/Xpr2Q8QdTyel0ZC49Wh5" alt=""><figcaption></figcaption></figure>
4. **Get Client ID and Client Secret**: Copy the Application (client) ID.

   <figure><img src="/files/G1BYfxXQMj6u1DuQBg39" alt=""><figcaption></figcaption></figure>

   * Enter it into the YOUR ARCHIVE Connector's Client ID field.

     <figure><img src="/files/TOsZlBy8a1N4AAp3S8sz" alt=""><figcaption></figcaption></figure>
   * Go to `Certificates & Secrets` and create a new client secret. Name it "YOUR ARCHIVE" and set the expiry to 24 months.

     <figure><img src="/files/b3bhYzOPanxFpcbtDBxf" alt=""><figcaption></figcaption></figure>

     * Copy the value to the Client Secret field in YOUR ARCHIVE.
     * **Important**: Do not refresh the Azure page before copying the secret.

   <figure><img src="/files/u9t800xB00YJC7YbSXom" alt=""><figcaption></figcaption></figure>
5. Configure API permissions:
   * After registration, go to **API Permissions** > **Add Permission**.
   * **Microsoft Graph > Delegated permissions**. \
     Add the permissions in the table below.
   * Grant admin consent for the permissions.
6. **Token and Authorization URLs**:
   * Use the Tenant ID to replace the "Common" placeholder in the URLs.
7. Save the OAuth configuration in both Azure AD and YOUR ARCHIVE. Test SSO login using Office 365 credentials.

## API Permissions

<table><thead><tr><th width="159">Name</th><th width="105">Scope</th><th width="110">Type</th><th width="129">Description</th><th>Purpose</th></tr></thead><tbody><tr><td>email</td><td>Microsoft Graph</td><td>Delegated</td><td>View users' email address</td><td></td></tr><tr><td>files.readwrite</td><td>Microsoft Graph</td><td>Delegated</td><td>Have full access to user files</td><td></td></tr><tr><td>mail.read</td><td>Microsoft Graph</td><td>Delegated</td><td>Read user mail</td><td>User Mailbox Access for Mailbox Reader or Folder Replication</td></tr><tr><td>mail.readwrite</td><td>Microsoft Graph</td><td>App</td><td>Read and write mail in all mailboxes</td><td>Restore to Mailbox, Mailbox Reader, Folder Replication</td></tr><tr><td>mail.send</td><td>Microsoft Graph</td><td>App</td><td>Send mail as any user</td><td>Mailbox Reader, Folder Replication, Reply/Compose/Forward</td></tr><tr><td>mailboxsettings.read</td><td>Microsoft Graph</td><td>Delegated</td><td>Read user mailbox settings</td><td></td></tr><tr><td>offline_access</td><td>Microsoft Graph</td><td>Delegated</td><td>Maintain access to data you have given it access to</td><td></td></tr><tr><td>openid</td><td>Microsoft Graph</td><td>Delegated</td><td>Sign users in</td><td></td></tr><tr><td>profile</td><td>Microsoft Graph</td><td>Delegated</td><td>View users' basic profile</td><td></td></tr><tr><td>user.read</td><td>Microsoft Graph</td><td>Delegated</td><td>Sign in and read user profile</td><td>Add Secondary Email addresses, First name and Surname, Account Creation date, User Principal Name (UPN), GUID to Archive User account. Without secondary addresses, users will only search content matching their primary address. User Creation date is required for search restrictions.</td></tr><tr><td>user.read.all</td><td>Microsoft Graph</td><td>App</td><td>Read all users' full profiles</td><td>Search and List user accounts when selecting accounts for Mailbox Reader, Folder Replication or User Directory.</td></tr><tr><td>user.readbasic.all</td><td>Microsoft Graph</td><td>Delegated</td><td>Read all users' basic profiles</td><td></td></tr><tr><td>full_access_as_app</td><td>Office 365 Exchange Online</td><td>App</td><td>Use Exchange Web Services with full access to all mailboxes</td><td>Restore to Mailbox</td></tr></tbody></table>

**Additional Resources:**

* [Azure AD OAuth Setup](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/configure-single-sign-on-non-gallery-applications)
* [OAuth 2.0 Permissions](https://learn.microsoft.com/en-us/graph/permissions-reference)