# Graph API with Auth Code (Delegated access)

## Registering an application

### Step 1 - Finding Azure Active Directory to manage your account

Visit the following link in your Microsoft Azure account (within your Azure Active Directory):\
<https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/RegisteredApps>

### Step 2 - Initiating an app registration

Click on **+ New registration**

<figure><img src="https://880912854-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mf8H-oTE_fhOrUtfYrN-2724419853%2Fuploads%2FpUR8FMRte2uBIadHbRJm%2Fimage.png?alt=media&#x26;token=349dd8af-546c-4a8c-b4bc-af6480634e9c" alt=""><figcaption></figcaption></figure>

### Step 3 - Account (tenant) type selection <a href="#enablingoauth2authorizationinyourmicrosofto365account-step3-account-tenant-typeselection" id="enablingoauth2authorizationinyourmicrosofto365account-step3-account-tenant-typeselection"></a>

Register your application as illustrated:

![Registering an application](https://880912854-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Femail-this-issue%2F-Mf8H2Dd9U6eVTBdoMg_%2F-Mf8I46hRP96dRDkZIAr%2F1863221346.png?generation=1626874874651883\&alt=media)

Make sure to add the following content to the fields:

* **Name**: An easily identifiable name.
* **Account type**: Select the account type to indicate whether it should be available for accounts outside your organization or not.
  * Single tenant: choose this if the app is accessible for your organizational directory
  * Multitenant: choose this if you want to allow any organizations to use this app
* **Redirect URI**: In the Redirect URI section, do the following:
  * Leave the Web as selected.&#x20;
  * Copy and paste the Redirect URI from the **OAuth2 Client Credentials** screen as the URI value. As this URL is specific to your Jira instance, it is essential to copy the URL from the Email This Issue app into this page.<br>

    <figure><img src="https://880912854-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mf8H-oTE_fhOrUtfYrN-2724419853%2Fuploads%2FXKz0C1ry5Gw56LjBKgjW%2Fimage.png?alt=media&#x26;token=d21af18e-a1df-403b-a1c5-e6c334a37fe6" alt=""><figcaption><p>Redirect URI</p></figcaption></figure>

### Step 4 - Define API permissions <a href="#enablingoauth2authorizationinyourmicrosofto365account-step4-defineapipermissions" id="enablingoauth2authorizationinyourmicrosofto365account-step4-defineapipermissions"></a>

API Permissions (scopes) need to be granted for the application.

1\. On the overview page of your newly created app select the **API permissions / Security -> Permission** menu. Click on the **Add a permission** button and select the *Microsoft Graph* group:

![Navigating to the API permission manager](https://880912854-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Femail-this-issue%2F-Mf8H2Dd9U6eVTBdoMg_%2F-Mf8I46nHQeNIzuQIqTx%2F1863221364.png?generation=1626874874658233\&alt=media)

2. Select **Delegated permissions** then find and select the permissions. Depending on your actual use case (i.e. the used messaging/communication protocol), the following permissions shall be added:

**2.1. General permissions (required for both incoming and outgoing connections)**\
General permissions are needed to acquire a refresh token and then manage access tokens (i.e. these are required in each and every use case).&#x20;

* **offline\_access**&#x20;
* **openid**
* **User.Read** (If not added by default, please manually add it now.)

<figure><img src="https://880912854-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mf8H-oTE_fhOrUtfYrN-2724419853%2Fuploads%2FXf5fMhaBWeifv86Z1glW%2F2025-11-27_14h47_42.png?alt=media&#x26;token=ee68e324-02b5-483a-92f1-626191f8ae61" alt=""><figcaption><p>General permissions</p></figcaption></figure>

**2.2. Graph API permissions to fetch messages**

* **Mail.ReadWrite**
* **Mail.ReadWrite.Shared**&#x20;

Permissions to use Graph API for incoming connections. These permissions can be found by entering `mail.` in the search field:

<figure><img src="https://880912854-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mf8H-oTE_fhOrUtfYrN-2724419853%2Fuploads%2F6h4QDu1XbmSzADYTkb1i%2F2024-10-22_10h48_44.png?alt=media&#x26;token=41f1a077-a4ef-49bd-8faf-34b17e1a6c86" alt=""><figcaption><p>Graph specific permissions for receiving emails</p></figcaption></figure>

*

**2.3. Graph API permissions to send messages**

* **Mail.Send**
* **Mail.Send.Shared**\
  \
  Permissions to use Graph API for incoming connections. These permissions can be found by entering `mail.` in the search field:

<figure><img src="https://880912854-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mf8H-oTE_fhOrUtfYrN-2724419853%2Fuploads%2FwwcskKFALYaU9WLoGEUX%2Fimage.png?alt=media&#x26;token=69fe3f5f-62ad-482f-8140-ccdea3f09e06" alt=""><figcaption></figcaption></figure>

### Step 5 - Generating a client secret <a href="#enablingoauth2authorizationinyourmicrosofto365account-step5-generateclientsecret" id="enablingoauth2authorizationinyourmicrosofto365account-step5-generateclientsecret"></a>

Generate a client secret to be used in [client credentials](https://docs.meta-inf.hu/email-this-issue/administration/email-this-issue-for-jira-cloud-oauth2-credentials).&#x20;

1\. Select the **Certificates & secrets** menu.

![Azure Active Directory: Certificates & secrets](https://880912854-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Femail-this-issue%2F-Mf8H2Dd9U6eVTBdoMg_%2F-Mf8I46qc4tEOcqhp-yV%2F1863221373.png?generation=1626874874632383\&alt=media)

2\. Click on the **New client secret** button to create a new client secret.

![Adding a new client secret](https://880912854-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mf8H-oTE_fhOrUtfYrN-2724419853%2Fuploads%2FMmTVnGXoABt2JCf2DXUe%2F2025-11-27_14h13_07.png?alt=media\&token=58cca22d-23d9-4e75-9a51-41e6639c93b0)

3\. Add a description.

4\. Select the expiration date that fits your needs&#x20;

5\. Click **Add**.

6\. Copy the **Client Secret Value** as you need to enter it into the Email This Issue app and it will not be visible in the Azure UI later.

### Step 6 - Copying data into Email This Issue <a href="#enablingoauth2authorizationinyourmicrosofto365account-step6-copyendpointsuris" id="enablingoauth2authorizationinyourmicrosofto365account-step6-copyendpointsuris"></a>

In Email This Issue go to OAuth2 credentials and click to create new credentials.

<figure><img src="https://880912854-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mf8H-oTE_fhOrUtfYrN-2724419853%2Fuploads%2F1He86LQZnply4ZWK2OI7%2Fimage.png?alt=media&#x26;token=4b2acd0f-6b1a-4ba7-a316-a65babf1cd81" alt=""><figcaption></figcaption></figure>

1. **Name**: a custom name for this entry.
2. **OAuht2 Service Provider**: Microsoft 0365
3. **Grant type**: Auth code
4. **Client ID**: the Application (client) ID - you can find it on the **Overview** screen

   ![The location of Client ID (aka Application ID) to copy from](https://880912854-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Femail-this-issue%2F-Mf8H2Dd9U6eVTBdoMg_%2F-Mf8I46jKxaum88dGrdC%2F1863221352.png?generation=1626874874649392\&alt=media)
5. **Client Secret**: this needs to be the Client Secret **Value** <br>

   <figure><img src="https://880912854-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mf8H-oTE_fhOrUtfYrN-2724419853%2Fuploads%2FaI7XiDhtn2UPM3heNu8e%2Fimage.png?alt=media&#x26;token=d09cf090-711d-419a-a3b7-ebb32b8bc63c" alt=""><figcaption><p>Location of the Client Secet Value to copy from</p></figcaption></figure>
6. **Auth Endpoint URL**: you can find this information on the Overview page of the registered application, selecting the Endpoint menu at the top. Ensure that you copy the **V2** endpoint.<br>

   <figure><img src="https://880912854-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mf8H-oTE_fhOrUtfYrN-2724419853%2Fuploads%2F4N3VQcfTImoyEgYVGQIQ%2Fimage.png?alt=media&#x26;token=d797032c-67b2-4e9e-a556-d690b9cd0735" alt=""><figcaption><p>Location of the Auth Endpoint URL to copy from</p></figcaption></figure>
7. **Token Endpoint URL**: you can find this information on the Overview page of the registered application, selecting the Endpoint menu at the top. Ensure that you copy the **V2** endpoint.<br>

   <figure><img src="https://880912854-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mf8H-oTE_fhOrUtfYrN-2724419853%2Fuploads%2FsCle2bjowOM7nTKUYz9f%2Fimage.png?alt=media&#x26;token=250b5d01-b52c-4e3b-860c-8bcde95ab7c7" alt=""><figcaption><p>Location of the Token Endpoint URL to copy from</p></figcaption></figure>

## Removing consent <a href="#enablingoauth2authorizationinyourmicrosofto365account-removingtheconsent" id="enablingoauth2authorizationinyourmicrosofto365account-removingtheconsent"></a>

In case you want to revoke the permission from the registered application to authenticate on your behalf, just visit <https://myapps.microsoft.com/> and delete the registered application from the list, as shown in the following image:

![Withdrawing personal consent (granted for an app previously)](https://880912854-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Femail-this-issue%2F-Mf8H2Dd9U6eVTBdoMg_%2F-Mf8I46sxEOohIvSZPGq%2F1863221379.png?generation=1626874874639541\&alt=media)

The released access token will still be valid within its validity period. Only by refreshing the access token will it fail for this specific account. The application registration is untouched and other accounts can continue to use it.