(Awaiting Approval) Configuring Microsoft 365 (Graph API)

This guide explains how to configure authentication for the Nextcloud Exchange Connector using the Microsoft Graph API.

Pre-requirements

Before you begin the app registration process, ensure you have the following:

1. Administrative Access: You must have Global Administrator privileges in your Microsoft Entra ID tenant to grant organizational consent for the required API permissions.

2. Active Microsoft 365 Tenant: An active Microsoft 365 subscription.

Step 1. Register the Application in Microsoft Entra

Why this is needed: Registering the application generates a unique Application (client) ID and Directory (tenant) ID. These identifiers act as the routing credentials for your connector to securely communicate with the Microsoft 365 cloud.

1. Open a browser and log in to the Microsoft Azure Portal.

2. Navigate to Microsoft Entra ID.

3. Navigate to App registrations (located in the left sidebar under Manage).

4. Click New registration at the top of the page.

5. Fill out the registration form with the following parameters:

   • Name: Enter a friendly name (e.g., Sendent Sync Service - Graph API).

   • Supported account types: Select Accounts in this organizational directory only (Single tenant).

   • Redirect URI: Leave this field empty.

6. Click Register.

7. Once the app is created, you will be redirected to the Overview page. Copy and save the following identifiers; you will need them later:

• Application (client) ID (This will be your AppId)

• Directory (tenant) ID (This will be your TenantId)

Step 2. Configure Permissions for App-only Access

Why this is needed: The connector operates as a background daemon without a signed-in user present. It requires "Application permissions" to interact with the Graph API and sync calendars and contacts across the organization.

1. In your app registration menu, navigate to Manage > API permissions.

2. Click Add a permission.

3. Select Microsoft Graph.

4. Select Application permissions.

5. Search for and check the following permissions:

   • Calendars.ReadWrite

   • Contacts.ReadWrite

   • User.Read.All

6. Click Add permissions.

Step 3. Create a Client Secret

Why this is needed: The Client Secret acts as the password for your newly registered application, proving its identity to Microsoft Entra ID when requesting an access token.

1. Navigate to Manage > Certificates & secrets.

2. Under the Client secrets tab, click New client secret.

3. Add a description and choose an expiration period, then click Add.

4. Immediately copy the Value of the client secret. You will not be able to view it again once you leave the page.

Step 4. Save Credentials for Installation

You have successfully generated the required Graph API access keys. Keep these values secure to build your configuration files.