Skip to content

External service — Microsoft

Give assistants access to each user's Microsoft 365 services: Outlook, SharePoint, OneDrive, Teams, etc.

Approach

Forra provides a shared Microsoft OAuth client (the Forra Mirego application in Entra ID). The service is not enabled by default on a new tenant — it must be pre-configured by the Forra team on request.

During pre-configuration, Forra enables the service with limited visibility (typically restricted to the organization administrator). This is intentional: until admin consent has been granted on the Entra side, a user trying to connect to the service would see an error or a consent prompt that fails. Limiting visibility avoids that confusion.

1. Request pre-configuration

Contact the Forra team to request activation of the Microsoft service. After this request:

  • The service appears in the OAuth Services section of the External Services tab.
  • Its visibility is set to a restricted scope (admin only) to allow the rest of the procedure without prematurely exposing it to users.

For your organization's users to authorize Forra to access their Microsoft 365 data, an Entra ID administrator must grant admin consent for the Forra application.

In Forra:

  1. Open your personal settings (as the Entra ID admin).
  2. Launch the connection to the Microsoft service.
  3. During the OAuth flow, check the option to grant consent on behalf of the organization.

Without this step, each user will see an individual consent dialog and some permissions will not be granted.

3. Broaden visibility in Forra

Once admin consent has been granted and the service is tested with your admin account:

  1. Open Tenant Admin → External Services → OAuth Services section.
  2. Open the Microsoft card.
  3. Broaden visibility: Public for the whole tenant, or assign specific groups/users as needed.
  4. Save.

4. Test with an end user

Ask a (non-admin) user to connect to the Microsoft service from their Forra settings to validate the flow.

Manual configuration (advanced)

To use your own Microsoft App registration instead of the shared client — useful if you want to control scopes or compliance — follow the Custom service procedure. The typical Microsoft Graph parameters are:

  • Authorize URL: https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/authorize
  • Access token URL: https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token
  • API base URL: https://graph.microsoft.com/v1.0/
  • Scopes: adjust based on the desired services (offline_access Mail.Read Files.Read.All Calendars.Read, etc.)

Contact the Forra team for the Redirect URI to declare in your App registration.