{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-agen-for-work/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["Notification","LightboxImage"]},"type":"markdown"},"seo":{"title":"Microsoft 365 integration","siteUrl":"https://developers.frontegg.com/","llmstxt":{"title":"Frontegg Developer Documentation","description":"Authentication, authorization, and user management for Customer Identity, plus Agen for SaaS and Agen for Work. Guides, SDKs, and API references.","sections":[{"title":"Customer Identity (CIAM)","description":"Auth, SSO, SCIM, entitlements, and user management — guides, SDKs, and APIs.","includeFiles":["ciam/**/*.md"],"excludeFiles":[]},{"title":"Agen for SaaS","description":"Agentic access and authorization for SaaS products.","includeFiles":["agen-for-saas/**/*.md"],"excludeFiles":[]},{"title":"Agen for Work","description":"Agentic access and authorization for internal and workforce use.","includeFiles":["agen-for-work/**/*.md"],"excludeFiles":[]},{"title":"Platform","description":"Shared platform overview.","includeFiles":["platform/**/*.md"],"excludeFiles":[]}],"excludeFiles":["internal-docs/**","ciam/guides/env-settings/inject-client-ip.md","CLAUDE.md",".claude/**","**/images/**"],"hide":false}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"microsoft-365-integration","__idx":0},"children":["Microsoft 365 integration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Microsoft 365 is Microsoft's suite of productivity and collaboration apps. This is a unified integration over Microsoft Graph — a single OAuth app that covers Entra ID (users and groups), Outlook mail and contacts, Calendar, Teams, OneDrive and Excel, SharePoint, To Do, and OneNote. Integrating Microsoft 365 with Frontegg lets your application work across all of these on behalf of your users through Frontegg's integration layer. Microsoft 365 authenticates with OAuth 2.0 (Authorization Code flow) via Microsoft Entra, so you register an app in the Microsoft Entra admin center to obtain a Client ID and Client Secret."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Notification","attributes":{"title":"Prerequisites","type":"attention"},"children":[{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://www.microsoft.com/microsoft-365"},"children":["Microsoft 365"]}," account with access to the ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://entra.microsoft.com/"},"children":["Microsoft Entra admin center"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Permission to register applications in your Microsoft Entra directory (and, for organization-wide use, to grant admin consent)"]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"connect-to-microsoft-365","__idx":1},"children":["Connect to Microsoft 365"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You register an application in Microsoft Entra. The app provides the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Application (client) ID"]}," and a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client Secret"]},", and defines the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["redirect URI"]}," that Microsoft returns users to after they authorize access. For single-tenant apps you also provide your ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Directory (tenant) ID"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"step-1-register-an-application","__idx":2},"children":["Step 1: Register an application"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Sign in to the ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://entra.microsoft.com/"},"children":["Microsoft Entra admin center"]}," and go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Entra ID → App registrations"]},". Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["New registration"]},", enter a name (for example ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Frontegg Integration"]},"), choose the supported account types that match your use case, and click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Register"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"step-2-copy-the-application-client-id-and-directory-tenant-id","__idx":3},"children":["Step 2: Copy the Application (client) ID and Directory (tenant) ID"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["On the app's ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Overview"]}," page, copy the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Application (client) ID"]}," — this is your ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client ID"]},". If your app is single-tenant, also copy the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Directory (tenant) ID"]},". For multi-tenant apps, you can leave the tenant ID as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["common"]}," in Frontegg."]},{"$$mdtype":"Tag","name":"LightboxImage","attributes":{"isLightbox":true},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/microsoft-365-1.dcb22ddb783a3fde33145d5a7b553c57f13f182bd6ae6bbed654ecb7420863b3.1ce25488.png","alt":"Microsoft Entra app Overview page showing the Application (client) ID and Directory (tenant) ID"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"step-3-add-the-redirect-uri","__idx":4},"children":["Step 3: Add the redirect URI"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Open ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authentication"]},", add a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Web"]}," platform (if not already present), and set the redirect URI to your Frontegg Redirect URL: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://YOUR_MCP_GATEWAY_URL/integration-callback"]}]},{"$$mdtype":"Tag","name":"LightboxImage","attributes":{"isLightbox":true},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/microsoft-365-2.3413835e269b230df3afc75c07e0020ea2208ac1bb694d10c097e2423df29578.1ce25488.png","alt":"Microsoft Entra Authentication page with a Web redirect URI"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"step-4-create-a-client-secret","__idx":5},"children":["Step 4: Create a client secret"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Open ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Certificates & secrets → Client secrets"]}," and click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["New client secret"]},". Add a description and an expiry, then click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add"]},". Copy the secret ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Value"]}," immediately."]},{"$$mdtype":"Tag","name":"Notification","attributes":{"title":"Copy your Client Secret now","type":"attention"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The secret ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Value"]}," is shown only once, right after you create it — Entra masks it afterward and shows only the Secret ID. Copy it immediately and store it securely; treat it like a password. If you lose it, create a new client secret."]}]},{"$$mdtype":"Tag","name":"LightboxImage","attributes":{"isLightbox":true},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/microsoft-365-3.94fa05dce49114bb57620f5443c24f15958c9939c5299d0015f4f96d564fa28c.1ce25488.png","alt":"Microsoft Entra Certificates & secrets page with a client secret"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"step-5-configure-microsoft-graph-permissions","__idx":6},"children":["Step 5: Configure Microsoft Graph permissions"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Open ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API permissions"]},". Frontegg requests the Microsoft Graph delegated permissions it needs during authorization, but for organization-wide use an administrator may need to click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Grant admin consent"]}," so users are not prompted individually. Use ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add a permission → Microsoft Graph → Delegated permissions"]}," if you want to pre-configure them."]},{"$$mdtype":"Tag","name":"LightboxImage","attributes":{"isLightbox":true},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/microsoft-365-4.5e5e94fbfd46f448e4b7854be91b4618c20d54eeddf5759d11f16b98fd72220d.1ce25488.png","alt":"Microsoft Entra API permissions page for Microsoft Graph"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"configure-the-frontegg-portal","__idx":7},"children":["Configure the Frontegg portal"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Once you have your ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client ID"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client Secret"]},", configure the integration in the Frontegg portal:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Open the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Frontegg portal"]}," and navigate to [ENVIRONMENT] → Integrations → Microsoft 365."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Enter the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client ID"]}," (Application (client) ID) and the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client Secret"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Enter your ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Directory (tenant) ID"]}," for a single-tenant app, or leave it as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["common"]}," for a multi-tenant app."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Save"]},"."]}]},{"$$mdtype":"Tag","name":"Notification","attributes":{"title":"Keep your credentials secure","type":"attention"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Never share or commit your Client Secret to version control."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"scopes","__idx":8},"children":["Scopes"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Frontegg requests Microsoft Graph delegated permissions covering the connected services, plus the OIDC basics (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["openid"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["profile"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["email"]},") and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["offline_access"]}," for refresh tokens:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Area"},"children":["Area"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Microsoft Graph permissions"},"children":["Microsoft Graph permissions"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Users & directory"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["User.Read"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["User.Read.All"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["User.ReadWrite.All"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Group.Read.All"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Group.ReadWrite.All"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Application.Read.All"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Directory.Read.All"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Mail & contacts"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Mail.Read"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Mail.ReadWrite"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Mail.Send"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["MailboxSettings.Read"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["MailboxSettings.ReadWrite"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Contacts.Read"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Contacts.ReadWrite"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Calendar"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Calendars.Read"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Calendars.Read.Shared"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Calendars.ReadWrite"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Teams"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Team.ReadBasic.All"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Team.Create"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Channel.ReadBasic.All"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Channel.Create"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ChannelMessage.Read.All"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ChannelMessage.Send"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Chat.Read"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Chat.ReadWrite"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Chat.Create"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["OnlineMeetings.ReadWrite"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["TeamMember.Read.All"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Files (OneDrive / Excel)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Files.Read"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Files.Read.All"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Files.ReadWrite"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Files.ReadWrite.All"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["SharePoint"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Sites.Read.All"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Sites.ReadWrite.All"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Sites.Manage.All"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Sites.FullControl.All"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Tasks (To Do)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Tasks.Read"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Tasks.ReadWrite"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Notes (OneNote)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Notes.Read"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Notes.Create"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Notes.ReadWrite"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"additional-resources","__idx":9},"children":["Additional resources"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app"},"children":["Register an application with the Microsoft identity platform"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://learn.microsoft.com/en-us/graph/permissions-reference"},"children":["Microsoft Graph permissions reference"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/agen-for-work/connectors/redirect-url"},"children":["How to get your Redirect URL"]}]}]}]}]},"headings":[{"value":"Microsoft 365 integration","id":"microsoft-365-integration","depth":2},{"value":"Connect to Microsoft 365","id":"connect-to-microsoft-365","depth":3},{"value":"Step 1: Register an application","id":"step-1-register-an-application","depth":4},{"value":"Step 2: Copy the Application (client) ID and Directory (tenant) ID","id":"step-2-copy-the-application-client-id-and-directory-tenant-id","depth":4},{"value":"Step 3: Add the redirect URI","id":"step-3-add-the-redirect-uri","depth":4},{"value":"Step 4: Create a client secret","id":"step-4-create-a-client-secret","depth":4},{"value":"Step 5: Configure Microsoft Graph permissions","id":"step-5-configure-microsoft-graph-permissions","depth":4},{"value":"Configure the Frontegg portal","id":"configure-the-frontegg-portal","depth":3},{"value":"Scopes","id":"scopes","depth":3},{"value":"Additional resources","id":"additional-resources","depth":3}],"frontmatter":{"category":"Productivity","seo":{"title":"Microsoft 365 integration"}},"lastModified":"2026-07-28T15:15:47.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/agen-for-work/connectors/marketplace/microsoft-365","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}