​
Overview

Pre-built tooling

Pre-built integrations

Access requirements

Setup guide

Useful links

API gotchas

​
Pre-built tooling

​
Pre-built integrations

No pre-built integration yet (time to contribute: <48h)

Not seeing the integration you need? Build your own independently.

​
Access requirements

Pre-RequisitesStatusComment
Paid dev account✅ Not requiredFree, self-signup for a Microsoft account and Azure account.
Paid test account✅ Not requiredFree Microsoft account can be used for testing.
Partnership✅ Not required
App review⚠️ ConditionalRequired only if you want to publish your app to the Microsoft commercial marketplace or if your app needs admin consent for certain permissions.
Security audit✅ Not required

​
Setup guide

1

Create a Microsoft account and Azure account

If you don’t already have them, sign up for a Microsoft account and an Azure account.

2

Register an application in Microsoft Entra ID

  1. Sign in to the Microsoft Entra admin center as at least an Application Developer.
  2. If you have access to multiple tenants, use the Settings icon in the top menu to switch to the tenant in which you want to register the application.
  3. From the search bar at the top of the Azure portal, search for App registrations and select it. Then choose New registration. Or from your left navigation tab, navigate to Applications > App registrations then choose New registration.
  4. Enter a meaningful name for your application, for example “Nango Integration”.
  5. Under Supported account types, select the appropriate option based on your needs:
    • Accounts in this organizational directory only - For single-tenant apps for use only by users in your tenant.
    • Accounts in any organizational directory - For multitenant apps that you want users in any Microsoft Entra tenant to be able to use.
    • Accounts in any organizational directory and personal Microsoft accounts - For multitenant apps that support both organizational and personal Microsoft accounts.
    • Personal Microsoft accounts - For apps used only by personal Microsoft accounts.
  6. Leave the Redirect URI section blank for now; we’ll configure it in a later step.
  7. Click Register to complete the app registration.
3

Note your application (client) ID

After registration, you’ll be taken to the application’s Overview page. Record the Application (client) ID, which uniquely identifies your application and is used in your application’s code as part of validating security tokens.

4

Add a redirect URI

  1. In the left sidebar, select Authentication.
  2. Under Platform configurations, select Add a platform.
  3. Select Web as the platform type.
  4. Enter https://api.nango.dev/oauth/callback as the Redirect URI.
  5. Under Implicit grant and hybrid flows, check the boxes for Access tokens and ID tokens if your application needs them.
  6. Under Advanced settings, set Allow public client flows to No for web applications.
  7. Click Configure to save your changes.
5

Add API permissions

  1. In the left sidebar, select API permissions.
  2. Click Add a permission.
  3. Select the API your application needs to access. Common choices include:
    • Microsoft Graph - For accessing Microsoft 365 data
    • Office 365 Exchange Online - For email and calendar access
    • Azure Key Vault - For accessing secrets
    • Dynamics CRM - For CRM data
  4. Choose the type of permissions:
    • Delegated permissions - Your app accesses the API as the signed-in user.
    • Application permissions - Your app accesses the API directly without a signed-in user.
  5. Select the specific permissions your app requires. For Microsoft Graph, common permissions include:
    • User.Read - Read user profile
    • Mail.Read - Read user mail
    • Calendars.ReadWrite - Read and write calendars
    • Files.Read - Read files
  6. Click Add permissions.
  7. If your application requires admin consent, click Grant admin consent for [tenant] to pre-authorize the permissions.
6

Create a client secret

  1. In the left sidebar, select Certificates & secrets.
  2. Under Client secrets, click New client secret.
  3. Enter a description for the secret and select an expiration period (6 months, 12 months, 24 months, or custom).
  4. Click Add.
  5. Important: Copy the secret value immediately and store it securely. You won’t be able to see it again after you leave this page.
7

Configure token settings (optional)

  1. In the left sidebar, select Token configuration.
  2. Here you can configure optional claims to be included in the ID and access tokens issued to your application.
  3. Click Add optional claim if you need to include additional information in your tokens.
8

Configure app visibility (optional)

If you want users to see your app on their My Apps page:

  1. From the search bar at the top of the Azure portal, search for Enterprise applications, select it, and then choose your app.
  2. On the Properties page, set Visible to users? to Yes.
9

Next

Follow the Quickstart.

Need help getting started? Get help in the community.
TopicLinks
GeneralMicrosoft Entra Admin Center
Azure Portal
Microsoft Graph Explorer
DeveloperMicrosoft identity platform documentation
Microsoft Graph API Overview
How to register an Application
OAuth 2.0 Authorization Code Flow
Microsoft Graph Permissions Reference
Microsoft Authentication Libraries (MSAL)
Microsoft Graph API Reference
Microsoft Graph Throttling Guidance
Redirect URI Best Practices
Contribute useful links by editing this page

​
Common Scopes

ScopeDescription
User.ReadRead user profile
Mail.ReadRead user mail
Calendars.ReadWriteRead and write calendars
Files.ReadRead files
offline_accessAccess to refresh tokens for offline access

​
API gotchas

  • Microsoft has a unified OAuth system for their various APIs. This provider should work for most of them (e.g. Microsoft EntraID, OneNote, Onedrive, Outlook, Sharepoint Online, Microsoft Teams etc.).
  • You can find permissions required for each API call in their corresponding API methods section, i.e, to retrieve a list of notebook objects from Onenote, you can have a look at List Notebooks permissions.
  • See particularly the tenant parameter under Request an authorization code.
  • This tenant parameter must be provided as extra configuration to the frontend SDK.
  • Make sure you request the offline_access scope to get a refresh token and keep access with your integration.
  • Microsoft offers a tool that allows you to construct and perform Graph API queries and see their response for any apps on which you have an admin, developer, or tester role. For more information you can check Microsoft Graph Explorer.
  • Please be aware that the Microsoft Graph API implements throttling to manage the volume of requests. For more information on handling throttling, refer to the Microsoft Graph Throttling Guidance.
  • Microsoft Graph API has different versions (v1.0 and beta). The v1.0 endpoint is for production use, while the beta endpoint contains features that are still in preview.
  • When requesting permissions that require admin consent, users without admin privileges will not be able to complete the OAuth flow unless an admin has pre-authorized the permissions.
  • For multitenant applications, you may need to handle tenant-specific endpoints and permissions.
  • You can set the .default scope documentation to ensure the permissions remain the same as those granted at the organization level.
  • The .default scope can’t be combined with the scopes registered in the Azure portal. So either just use the .default scope or remove it to list out explicit parameters that are required. If you attempt to combine them you’ll receive the following error
.default scope can't be combined with resource-specific scopes
  • If you require a user to reauthenticate and force them to accept scopes that have been updated or changed you can force a prompt via the authorization_params:
const { data } = await nango.createConnectSession({
  [...],
  integrations_config_defaults: {
    "<provider-name>": {
      authorization_params: {
        "prompt": "consent"
      }
    }
  }
});
You can use this provider for general Microsoft Graph access (and the major Microsoft SaaS services like Teams, OneDrive, other Office 365 services, etc.) by setting the tenant to common but we recommend using the Microsoft Teams provider instead which includes sync capability.
Contribute API gotchas by editing this page

​
Overview

Pre-built tooling

Pre-built integrations

Access requirements

Setup guide

Useful links

API gotchas

​
Pre-built tooling

​
Pre-built integrations

No pre-built integration yet (time to contribute: <48h)

Not seeing the integration you need? Build your own independently.

​
Access requirements

Pre-RequisitesStatusComment
Paid dev account✅ Not requiredFree, self-signup for a Microsoft account and Azure account.
Paid test account✅ Not requiredFree Microsoft account can be used for testing.
Partnership✅ Not required
App review⚠️ ConditionalRequired only if you want to publish your app to the Microsoft commercial marketplace or if your app needs admin consent for certain permissions.
Security audit✅ Not required

​
Setup guide

1

Create a Microsoft account and Azure account

If you don’t already have them, sign up for a Microsoft account and an Azure account.

2

Register an application in Microsoft Entra ID

  1. Sign in to the Microsoft Entra admin center as at least an Application Developer.
  2. If you have access to multiple tenants, use the Settings icon in the top menu to switch to the tenant in which you want to register the application.
  3. From the search bar at the top of the Azure portal, search for App registrations and select it. Then choose New registration. Or from your left navigation tab, navigate to Applications > App registrations then choose New registration.
  4. Enter a meaningful name for your application, for example “Nango Integration”.
  5. Under Supported account types, select the appropriate option based on your needs:
    • Accounts in this organizational directory only - For single-tenant apps for use only by users in your tenant.
    • Accounts in any organizational directory - For multitenant apps that you want users in any Microsoft Entra tenant to be able to use.
    • Accounts in any organizational directory and personal Microsoft accounts - For multitenant apps that support both organizational and personal Microsoft accounts.
    • Personal Microsoft accounts - For apps used only by personal Microsoft accounts.
  6. Leave the Redirect URI section blank for now; we’ll configure it in a later step.
  7. Click Register to complete the app registration.
3

Note your application (client) ID

After registration, you’ll be taken to the application’s Overview page. Record the Application (client) ID, which uniquely identifies your application and is used in your application’s code as part of validating security tokens.

4

Add a redirect URI

  1. In the left sidebar, select Authentication.
  2. Under Platform configurations, select Add a platform.
  3. Select Web as the platform type.
  4. Enter https://api.nango.dev/oauth/callback as the Redirect URI.
  5. Under Implicit grant and hybrid flows, check the boxes for Access tokens and ID tokens if your application needs them.
  6. Under Advanced settings, set Allow public client flows to No for web applications.
  7. Click Configure to save your changes.
5

Add API permissions

  1. In the left sidebar, select API permissions.
  2. Click Add a permission.
  3. Select the API your application needs to access. Common choices include:
    • Microsoft Graph - For accessing Microsoft 365 data
    • Office 365 Exchange Online - For email and calendar access
    • Azure Key Vault - For accessing secrets
    • Dynamics CRM - For CRM data
  4. Choose the type of permissions:
    • Delegated permissions - Your app accesses the API as the signed-in user.
    • Application permissions - Your app accesses the API directly without a signed-in user.
  5. Select the specific permissions your app requires. For Microsoft Graph, common permissions include:
    • User.Read - Read user profile
    • Mail.Read - Read user mail
    • Calendars.ReadWrite - Read and write calendars
    • Files.Read - Read files
  6. Click Add permissions.
  7. If your application requires admin consent, click Grant admin consent for [tenant] to pre-authorize the permissions.
6

Create a client secret

  1. In the left sidebar, select Certificates & secrets.
  2. Under Client secrets, click New client secret.
  3. Enter a description for the secret and select an expiration period (6 months, 12 months, 24 months, or custom).
  4. Click Add.
  5. Important: Copy the secret value immediately and store it securely. You won’t be able to see it again after you leave this page.
7

Configure token settings (optional)

  1. In the left sidebar, select Token configuration.
  2. Here you can configure optional claims to be included in the ID and access tokens issued to your application.
  3. Click Add optional claim if you need to include additional information in your tokens.
8

Configure app visibility (optional)

If you want users to see your app on their My Apps page:

  1. From the search bar at the top of the Azure portal, search for Enterprise applications, select it, and then choose your app.
  2. On the Properties page, set Visible to users? to Yes.
9

Next

Follow the Quickstart.

Need help getting started? Get help in the community.
TopicLinks
GeneralMicrosoft Entra Admin Center
Azure Portal
Microsoft Graph Explorer
DeveloperMicrosoft identity platform documentation
Microsoft Graph API Overview
How to register an Application
OAuth 2.0 Authorization Code Flow
Microsoft Graph Permissions Reference
Microsoft Authentication Libraries (MSAL)
Microsoft Graph API Reference
Microsoft Graph Throttling Guidance
Redirect URI Best Practices
Contribute useful links by editing this page

​
Common Scopes

ScopeDescription
User.ReadRead user profile
Mail.ReadRead user mail
Calendars.ReadWriteRead and write calendars
Files.ReadRead files
offline_accessAccess to refresh tokens for offline access

​
API gotchas

  • Microsoft has a unified OAuth system for their various APIs. This provider should work for most of them (e.g. Microsoft EntraID, OneNote, Onedrive, Outlook, Sharepoint Online, Microsoft Teams etc.).
  • You can find permissions required for each API call in their corresponding API methods section, i.e, to retrieve a list of notebook objects from Onenote, you can have a look at List Notebooks permissions.
  • See particularly the tenant parameter under Request an authorization code.
  • This tenant parameter must be provided as extra configuration to the frontend SDK.
  • Make sure you request the offline_access scope to get a refresh token and keep access with your integration.
  • Microsoft offers a tool that allows you to construct and perform Graph API queries and see their response for any apps on which you have an admin, developer, or tester role. For more information you can check Microsoft Graph Explorer.
  • Please be aware that the Microsoft Graph API implements throttling to manage the volume of requests. For more information on handling throttling, refer to the Microsoft Graph Throttling Guidance.
  • Microsoft Graph API has different versions (v1.0 and beta). The v1.0 endpoint is for production use, while the beta endpoint contains features that are still in preview.
  • When requesting permissions that require admin consent, users without admin privileges will not be able to complete the OAuth flow unless an admin has pre-authorized the permissions.
  • For multitenant applications, you may need to handle tenant-specific endpoints and permissions.
  • You can set the .default scope documentation to ensure the permissions remain the same as those granted at the organization level.
  • The .default scope can’t be combined with the scopes registered in the Azure portal. So either just use the .default scope or remove it to list out explicit parameters that are required. If you attempt to combine them you’ll receive the following error
.default scope can't be combined with resource-specific scopes
  • If you require a user to reauthenticate and force them to accept scopes that have been updated or changed you can force a prompt via the authorization_params:
const { data } = await nango.createConnectSession({
  [...],
  integrations_config_defaults: {
    "<provider-name>": {
      authorization_params: {
        "prompt": "consent"
      }
    }
  }
});
You can use this provider for general Microsoft Graph access (and the major Microsoft SaaS services like Teams, OneDrive, other Office 365 services, etc.) by setting the tenant to common but we recommend using the Microsoft Teams provider instead which includes sync capability.
Contribute API gotchas by editing this page