Approve Microsoft 365 access
- Tobias Viehweger
- Tamara Braun
- Benjamin Linser
Why is an approval needed?
Using our app requires delegated access to Microsoft 365, via the Microsoft Graph API. We use the most common form of delegated authentication flow, the authentication code flow via an Enterprise application. In many cases, access to Microsoft Graph resources is restricted by default. If you can’t login from Jira or Microsoft Teams, your Microsoft 365 or Azure administrator might need to consent to the app for you.
In case you are interested in the exact permissions and why we need them, please check out this dedicated permissions article.
Technical ids & scopes
Below you can find a list of necessary client ids and scopes. You only need to allow the Enterprise apps in case the feature should be used. Depending on the feature, there are also optional scopes which enhance the basic functionality, but are considered optional by us and can be omitted if not required - the app will gracefully handle the missing scopes.
The following base scopes are required for all features:
email
offline_access
profile
openidApp feature | Enterprise app client id | Scopes |
|---|---|---|
|
Mail.ReadWrite.Shared
Mail.Send.Shared
People.Read
User.Read
User.ReadBasic.All | |
Meetings |
|
Calendars.ReadWrite
Calendars.ReadWrite.Shared
MailboxSettings.Read
OnlineMeetings.ReadWrite
People.Read
User.Read
User.ReadBasic.Alloptional Necessary for certain features to work, e.g. searching for rooms
|
Calendar |
|
optional Necessary for certain features to work, e.g. searching for rooms & embedding Teams channel calendars |
To Do |
| |
Teams |
| |
Teams JSM portal |
| |
Teams JSM portal notifications |
| Since the portal link is an individual link we can’t provide a direct link to approve for all users. Feel free to see our docs to get the direct link: Approve for all users |
Approving access for all users for our apps
To approve access for all users for the relevant apps, please send your Office 365 administrator the following links or use the links above. In this case your admin has to approve for every app separately.
App feature | Approval link |
|---|---|
| |
Meetings |
With room support
|
Calendar | Only mandatory scopes:
With Teams channel calendar, group & room support
|
To Do |
|
Teams |
|
Teams JSM portal |
|
Your admin will see the following screen, where the permissions can be confirmed.
Please note, that despite what the screen says in the subtext, we won’t get access to all user resources automatically after approving this. Before we can get access to any Office data, the users will need to log in with their own account as well from Jira.
Approving access for a limited set of users
In case you only want to approve the access for a limited set of users, e.g. you already have a dedicated AzureAD group for Jira users, you’ll need to do this via a Powershell script. The easiest way is to create a new .ps1 file on your computer and paste the following code. Make sure to adjust the client ids and scopes according to the table above.
Creating the Enterprise application only for review purposes
In case you want to inspect the app first before approving is, you can just add the service principal to AzureAD.
Do do this, you’ll need to use Powershell to create it manually. For the “AppId” parameter, use one of the client ids listed in the table above, in this case the one for Teams.
Afterwards, you should be able to find the enterprise app in the UI linked above, where you can restrict the application to certain users or groups, or, using the “Properties” page, allow users to self-approve the app:
References
https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-admin-consent-workflow
https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/grant-admin-consent
https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/grant-admin-consent