Connect Microsoft 365 with your own Entra ID app

Most organisations should connect with application mode or delegate mode, which use Offision’s own app registration and need no credentials at all.

Use this path when that is not acceptable — when your security policy requires the application to be registered in your own Microsoft Entra ID, with permissions you choose and a secret you control and can revoke.

What to have ready

• An app registration in Microsoft Entra ID, or the ability to create one
• Its Directory (tenant) ID and Application (client) ID
• A client secret value — copy it when it is created, because Microsoft will not show it again
• Somewhere to paste two redirect URIs back into that registration
• Half an hour, and patience with Microsoft’s permission propagation

1. Open the customize path

Open the Microsoft 365 tile, choose Connect to Microsoft 365 account, then below the separator choose Customize — Bring your own Microsoft Entra ID app or customize permissions.

The wizard has two steps, listed down the left: Mode, then Credentials.

2. Choose the mode

Modes are laid out in two columns, Application and Delegated. The column decides how Offision acts against Microsoft: an application-family mode acts as the application itself, so one admin consent covers the organisation and there is no mailbox to keep alive. A delegated mode acts as a signed-in account, and reaches only what that account can reach.

Functions under the matrix shows the same three capabilities for whichever mode is selected, so you can check your choice before moving on.

3. Grant the permissions the wizard lists

Below the mode matrix, Permission requirement lists exactly what that mode needs, each marked Application or Delegated — which is the kind of permission to add in Entra ID, not a detail you can ignore. Use the Copy button and send the list to whoever owns the app registration.

For the application family:

For the delegated family:

Grant admin consent for the permissions in Entra ID. Adding them is not the same as consenting to them, and a registration with permissions listed but not consented behaves exactly like one with no permissions at all.

4. Enter the credentials

Move to Credentials and fill in:

Then copy the two redirect URIs Offision shows and add them to the app registration. Sign-in will fail later if they are missing, and the failure looks like a bad password rather than a missing URI.

5. Test the connection

On an application-family mode, use Test connection before saving. A green result means Offision could actually get a token with your credentials — which is a much better place to find a typo than three screens later.

On a delegated mode there is no Test connection button, because nothing has signed in yet and there is no token to test. Its absence is expected.

Save, then set up rooms, people and sign-in.

When it goes wrong