Microsoft
Register one Entra app for all eleven Microsoft connectors.
One Entra app registration covers every Microsoft connector. Each connector still has its own redirect URI, and each person connects each service separately.
This page is for self-hosted installs. On Flowblocks Cloud these connectors work without any setup.
Permissions
| Connector | Delegated permissions |
|---|---|
| Teams | Chat.Read |
| Outlook Email | Mail.Read |
| Outlook Calendar | Calendars.Read |
| Outlook Contacts | Contacts.Read |
| SharePoint | Sites.Read.All, Files.Read.All |
| OneDrive | Files.Read |
| Excel | Files.Read |
| OneNote | Notes.Read |
| Microsoft To Do | Tasks.Read |
| Microsoft Planner | Tasks.Read |
| Teams Channels | Team.ReadBasic.All, Channel.ReadBasic.All, ChannelMessage.Read.All |
Every connector also requests User.Read and offline_access.
ChannelMessage.Read.All always needs a tenant admin's consent, so in each company an admin approves Teams Channels once before anyone there can connect it. For people in other companies to connect at all, the app must be multi-tenant; verifying the publisher keeps tenants from blocking consent to an unverified app.
Register the app
Open App registrations in the Microsoft Entra admin center and choose New registration. Pick the supported account type:
- Leave
MICROSOFT_TENANT_IDunset and choose Accounts in any organizational directory and personal Microsoft accounts. Flowblocks then uses thecommonendpoint. - Or choose Single tenant and set
MICROSOFT_TENANT_IDto that directory's tenant id.
Add the redirect URIs
Open Authentication, then Add a platform, then Web. Use Web, not Single-page application, because the app has a client secret. Add:
http://localhost:3000/api/auth/oauth2/callback/connector_microsoftteams
http://localhost:3000/api/auth/oauth2/callback/connector_outlookcalendar
http://localhost:3000/api/auth/oauth2/callback/connector_outlookemail
http://localhost:3000/api/auth/oauth2/callback/connector_sharepoint
http://localhost:3000/api/auth/oauth2/callback/connector_outlookcontacts
http://localhost:3000/api/auth/oauth2/callback/connector_onedrive
http://localhost:3000/api/auth/oauth2/callback/connector_excel
http://localhost:3000/api/auth/oauth2/callback/connector_onenote
http://localhost:3000/api/auth/oauth2/callback/connector_microsofttodo
http://localhost:3000/api/auth/oauth2/callback/connector_planner
http://localhost:3000/api/auth/oauth2/callback/connector_teamschannelsCreate a secret
Open Certificates & secrets, then New client secret, and copy the secret's Value immediately. The Application (client) ID on the Overview page is the client id.
MICROSOFT_CLIENT_ID=
MICROSOFT_CLIENT_SECRET=
MICROSOFT_TENANT_ID=Grant permissions
Open API permissions, then Add a permission, then Microsoft Graph, then Delegated permissions. Add User.Read, offline_access and the permissions in the table above for each connector you offer.
Choose Grant admin consent if the tenant requires it. Sites.Read.All and Files.Read.All usually do, and ChannelMessage.Read.All always does.
Troubleshooting
Teams Channels asks for an admin. Consent for ChannelMessage.Read.All is missing in that tenant. An admin grants it once, from the consent prompt or from Enterprise applications in Entra.
SharePoint connects, then fails when a tool runs. Admin consent is missing for Sites.Read.All or Files.Read.All.
Microsoft returns redirect_uri is not valid. The URI in the error is missing from the Web platform list, or does not match character for character. Changes can take a minute to apply.