# Graph API with Client Credentials Grant (Application access)

## Registering an application

### Step 1 - Finding Azure Active Directory to manage your account

Visit the following link in your Microsoft Azure account (within your Azure Active Directory):\
<https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/RegisteredApps>

### Step 2 - Initiating an app registration

Click on **+ New registration**

<figure><img src="https://880912854-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mf8H-oTE_fhOrUtfYrN-2724419853%2Fuploads%2FpUR8FMRte2uBIadHbRJm%2Fimage.png?alt=media&#x26;token=349dd8af-546c-4a8c-b4bc-af6480634e9c" alt=""><figcaption></figcaption></figure>

### Step 3 - Account (tenant) type selection <a href="#enablingoauth2authorizationinyourmicrosofto365account-step3-account-tenant-typeselection" id="enablingoauth2authorizationinyourmicrosofto365account-step3-account-tenant-typeselection"></a>

Register your application as illustrated:

![Registering an application](https://880912854-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Femail-this-issue%2F-Mf8H2Dd9U6eVTBdoMg_%2F-Mf8I46hRP96dRDkZIAr%2F1863221346.png?generation=1626874874651883\&alt=media)

Make sure to add the following content to the fields:

* **Name**: An easily identifiable name.
* **Account type**: Select the account type to indicate whether it should be available for accounts outside your organization or not.
  * Single tenant: choose this if the app is accessible for your organizational directory
  * Multitenant: choose this if you want to allow any organizations to use this app
* **Redirect URI**: In the Redirect URI section, do the following:
  * Leave the Web as selected.&#x20;
  * Copy and paste the Redirect URI from the **OAuth2 Client Credentials** screen as the URI value. As this URL is specific to your Jira instance, it is essential to copy the URL from the Email This Issue app into this page.<br>

    <figure><img src="https://880912854-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mf8H-oTE_fhOrUtfYrN-2724419853%2Fuploads%2FXKz0C1ry5Gw56LjBKgjW%2Fimage.png?alt=media&#x26;token=d21af18e-a1df-403b-a1c5-e6c334a37fe6" alt=""><figcaption><p>Redirect URI</p></figcaption></figure>

{% hint style="warning" %}
Important: As of now the OAuth2 for SMTP/IMAP is not supported for personal Microsoft accounts.
{% endhint %}

### Step 4 - Define API permissions <a href="#enablingoauth2authorizationinyourmicrosofto365account-step4-defineapipermissions" id="enablingoauth2authorizationinyourmicrosofto365account-step4-defineapipermissions"></a>

API Permissions (scopes) need to be granted for the application. The following permissions are required for the Grant flow:

* Mail.ReadWrite
* Mail.Send
* User.Read.All

1\. On the overview page of your newly created app select the **API permissions / Security -> Permission** menu. Click on the **Add a permission** button and select the *Microsoft Graph* group:

![Navigating to the API permission manager](https://880912854-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Femail-this-issue%2F-Mf8H2Dd9U6eVTBdoMg_%2F-Mf8I46nHQeNIzuQIqTx%2F1863221364.png?generation=1626874874658233\&alt=media)

2. Select **Application permissions** then find and select the permissions. Depending on your actual use case (i.e. the used messaging/communication protocol), the following permissions shall be added:

**2.1. General permissions (required for both incoming and outgoing connections)**\
General permissions are needed to acquire a refresh token and then manage access tokens (i.e. these are required in each and every use case).&#x20;

* **User.Read.All** <br>

  <figure><img src="https://880912854-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mf8H-oTE_fhOrUtfYrN-2724419853%2Fuploads%2FRlk2DRHUG21YgsjUFXrB%2Fimage.png?alt=media&#x26;token=b09da7de-538f-4cd2-847a-125e1a5f8f19" alt=""><figcaption></figcaption></figure>

**2.2. Graph API permission to fetch messages**

* **Mail.ReadWrite**<br>

  <figure><img src="https://880912854-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mf8H-oTE_fhOrUtfYrN-2724419853%2Fuploads%2FuIpz7Fw8NDXzCYinY49Q%2Fimage.png?alt=media&#x26;token=7aded34a-af68-4943-b768-41b69ae231c4" alt=""><figcaption></figcaption></figure>

**2.3. Graph API permissions to send messages**

* **Mail.Send**<br>

  <figure><img src="https://880912854-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mf8H-oTE_fhOrUtfYrN-2724419853%2Fuploads%2F0poMp2N1VxWYbybxzcyj%2Fimage.png?alt=media&#x26;token=f00a6120-0315-4197-ba20-e5127d553920" alt=""><figcaption></figcaption></figure>

3. **Grant admin consent** after adding permissions.

<figure><img src="https://880912854-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mf8H-oTE_fhOrUtfYrN-2724419853%2Fuploads%2FO5LOYBQlS8YtajcN38e3%2FMicrosoft-grant-API-permissions.jpeg?alt=media&#x26;token=861d080f-a0ac-4195-acd5-d7abc178f0a7" alt=""><figcaption><p>Full List of Permissions with Admin Consent Granted</p></figcaption></figure>

### Step 5 - Generating a client secret <a href="#enablingoauth2authorizationinyourmicrosofto365account-step5-generateclientsecret" id="enablingoauth2authorizationinyourmicrosofto365account-step5-generateclientsecret"></a>

Generate a client secret to be used in [client credentials](https://docs.meta-inf.hu/email-this-issue/administration/email-this-issue-for-jira-cloud-oauth2-credentials).&#x20;

1\. Select the **Certificates & secrets** menu.

![Azure Active Directory: Certificates & secrets](https://880912854-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Femail-this-issue%2F-Mf8H2Dd9U6eVTBdoMg_%2F-Mf8I46qc4tEOcqhp-yV%2F1863221373.png?generation=1626874874632383\&alt=media)

2\. Click on the **New client secret** button to create a new client secret.

![Adding a new client secret](https://880912854-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Femail-this-issue%2F-Mf8H2Dd9U6eVTBdoMg_%2F-Mf8I46rd2z_0uBQMB_7%2F1863221376.png?generation=1626874874650456\&alt=media)

3\. Add a description.

4\. Select the expiration date that fits your needs&#x20;

5\. Click **Add**.

Copy the Client Secret Value, as you need to enter it into the Email This Issue app, and it will not be visible in the Azure UI later.Copy the **Client Secret Value** as you need to enter it into the Email This Issue app and it will not be visible in the Azure UI later.

### Step 6 - Copying data into Email This Issue <a href="#enablingoauth2authorizationinyourmicrosofto365account-step6-copyendpointsuris" id="enablingoauth2authorizationinyourmicrosofto365account-step6-copyendpointsuris"></a>

In Email This Issue go to OAuth2 credentials and click to create new credentials.

<figure><img src="https://880912854-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mf8H-oTE_fhOrUtfYrN-2724419853%2Fuploads%2F9q0t1szq26kjrGH6haCg%2F2025-11-27_14h35_34.png?alt=media&#x26;token=fd998d42-cf9d-46c9-9c5a-1aa83475637f" alt=""><figcaption></figcaption></figure>

1. **Name**: a custom name for this entry.
2. **OAuht2 Service Provider**: Microsoft 0365
3. **Grant type**: Client Credentials
4. **Client ID**: the Application (client) ID - you can find it on the **Overview** screen

   ![The location of Client ID (aka Application ID) to copy from](https://880912854-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Femail-this-issue%2F-Mf8H2Dd9U6eVTBdoMg_%2F-Mf8I46jKxaum88dGrdC%2F1863221352.png?generation=1626874874649392\&alt=media)
5. **Client Secret**: this needs to be the Client Secret **Value** <br>

   <figure><img src="https://880912854-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mf8H-oTE_fhOrUtfYrN-2724419853%2Fuploads%2FaI7XiDhtn2UPM3heNu8e%2Fimage.png?alt=media&#x26;token=d09cf090-711d-419a-a3b7-ebb32b8bc63c" alt=""><figcaption><p>Location of the Client Secet Value to copy from</p></figcaption></figure>
6. **Auth Endpoint URL**: is NOT required for this type of connection<br>
7. **Token Endpoint URL**: you can find this information on the Overview page of the registered application, selecting the Endpoint menu at the top. Ensure that you copy the **V2** endpoint

<figure><img src="https://880912854-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mf8H-oTE_fhOrUtfYrN-2724419853%2Fuploads%2FsCle2bjowOM7nTKUYz9f%2Fimage.png?alt=media&#x26;token=250b5d01-b52c-4e3b-860c-8bcde95ab7c7" alt=""><figcaption><p>Location of the Token Endpoint URL to copy from</p></figcaption></figure>

8. **You do NOT need to Authorize the connection.** Authorization was already completed on the Azure side at the end of Step 4.<br>