Connect Microsoft 365

≈ 6 min Extension OAuth2

Before you start

• A Microsoft account (personal, work or school).
• Access to the Azure portal to register an app (free). Work accounts may need an admin to approve the permissions.
• The AWFlow browser extension. These steps run in the extension (the web app hands them to it).

Used by

• Microsoft 365

Set it up

This is the only method. Microsoft 365 uses a public client: only the Application (client) ID is stored, never a secret.

1. Register an app in the Azure portal’s App registrations: New registration, any name, Accounts in any organizational directory and personal Microsoft accounts.

2. Add the redirect URI as a Single-page application. Copy it from the credential form in AWFlow (step 4 shows where), then click Register.

3. Add permissions. In API permissions › Add a permission › Microsoft Graph › Delegated permissions, add offline_access, Mail.ReadWrite, Mail.Send, Files.ReadWrite, Calendars.ReadWrite and Tasks.ReadWrite.

4. Fill the credential in AWFlow. Open Credentials and click Add Credential, then fill the New Credential form. In the browser side panel the form comes in two steps: tap Microsoft 365 in the list, then fill the rest.

   1234567

   1. 1 Step 1:Pick Microsoft 365 Under Integration App / Service, pick Microsoft 365. There is no Auth Type menu: Microsoft 365 uses OAuth2.
   2. 2 Step 2:Name it For example Microsoft 365 – work. A Description is optional.
   3. 3 Step 3:Copy the redirect URI Open Create your Microsoft OAuth client: it shows your redirect URI with a Copy button, for step 2.
   4. 4 Step 4:Paste the Application (client) ID From the app's Overview page, into Client ID. There is no secret field.
   5. 5 Step 5:Click Check connection Sign in to Microsoft and accept the permissions.
   6. 6 Step 6:Check where it is saved Signed in, choose Local (this browser only) or Cloud (synced to your account) under Storage location. Without an account it is saved locally in this browser, as here.
   7. 7 Step 7:Click Create Credential Check: the credential is listed on the Credentials page, ready to pick in Microsoft 365 nodes.

   Numbered areas in the screenshot: 1. Integration App / Service: Microsoft 365; 2. Name; 3. Create your Microsoft OAuth client guide; 4. Client ID; 5. Check connection (sign in); 6. Where the secret is stored (here, locally in this browser); 7. Create Credential.

Check it's connected — 

Check connection shows Connection successful. Then run Mail › List in a Microsoft 365 node: your latest messages come back.

Where your token lives

Where your token lives — 

Only the Application (client) ID is saved in the credential. The tokens Microsoft returns are kept in this browser’s storage and never synced to your account.

The credential itself is stored where you choose:

• Local (this browser only): encrypted in this browser. The encryption key is kept on the same device, so turn on the local secret vault to lock it with a passphrase only you know.
• Cloud (synced to your account): sent over an encrypted connection and stored encrypted on AWFlow’s server, so it works on your other devices.

When a step runs, your browser sends it only to login.microsoftonline.com (sign-in) and graph.microsoft.com (the API). AWFlow’s servers never relay the call.

Privacy & your data →

Permissions each operation needs

Operation	Delegated permission
Mail · Send	Mail.Send
Mail · List, Get, Draft	Mail.ReadWrite
File · Upload, List, Get link (OneDrive)	Files.ReadWrite
Calendar · Create event, List	Calendars.ReadWrite
To Do · Create task, List	Tasks.ReadWrite
Stay signed in (refresh token)	offline_access

Common issues

• AADSTS50011 (redirect URI mismatch). The URI isn’t registered, or it was added as Web instead of Single-page application. Copy it again from the credential form.
• “Need admin approval”. Your organization lets only admins grant these permissions. Ask an admin to grant consent for the app, or use a personal account.
• 403 on one operation. A permission is missing in API permissions. Add it, then click Check connection again.
• The run is blocked in the web app. Microsoft 365 runs through the browser extension. Install the extension and allow Microsoft 365 for this workflow when asked, or run the workflow from the extension. See Extension-only integrations in the web app.

Related

Microsoft 365 node

All connections

Create and manage credentials

Privacy & your data