Graph API with Client Credentials Grant (Application access)

Registering an application

Step 1 - Finding Azure Active Directory to manage your account

Visit the following link in your Microsoft Azure account (within your Azure Active Directory): https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/RegisteredApps

Step 2 - Initiating an app registration

Click on + New registration

Step 3 - Account (tenant) type selection

Register your application as illustrated:

Registering an application

Make sure to add the following content to the fields:

• Name: An easily identifiable name.

• Account type: Select the account type to indicate whether it should be available for accounts outside your organization or not.

  • Single tenant: choose this if the app is accessible for your organizational directory

  • Multitenant: choose this if you want to allow any organizations to use this app

• Redirect URI: In the Redirect URI section, do the following:

  • Leave the Web as selected.

  • Copy and paste the Redirect URI from the OAuth2 Client Credentials screen as the URI value. As this URL is specific to your Jira instance, it is essential to copy the URL from the Email This Issue app into this page.

    

    Redirect URI

Important: As of now the OAuth2 for SMTP/IMAP is not supported for personal Microsoft accounts.

Step 4 - Define API permissions

API Permissions (scopes) need to be granted for the application. The following permissions are required for the Grant flow:

• Mail.ReadWrite

• Mail.Send

• User.Read.All

1. On the overview page of your newly created app, select the API permissions / Security -> Permission menu. Click on the Add a permission button and select the Microsoft Graph group:

Navigating to the API permission manager

1. Select Application permissions, then find and select the permissions. Depending on your actual use case (i.e., the used messaging/communication protocol), the following permissions shall be added:

2.1. General permissions (required for both incoming and outgoing connections) General permissions are needed to acquire a refresh token and then manage access tokens (i.e., these are required in each and every use case).

• User.Read.All

  

2.2. Graph API permission to fetch messages

• Mail.ReadWrite

  

2.3. Graph API permissions to send messages

• Mail.Send

  

1. Grant admin consent after adding permissions.

Full List of Permissions with Admin Consent Granted

Step 5 - Generating a client secret

Generate a client secret to be used in client credentials.

1. Select the Certificates & secrets menu.

Azure Active Directory: Certificates & secrets

2. Click on the New client secret button to create a new client secret.

Adding a new client secret

3. Add a description.

4. Select the expiration date that fits your needs

5. Click Add.

Copy the Client Secret Value, as you need to enter it into the Email This Issue app, and it will not be visible in the Azure UI later. Copy the Client Secret Value, as you need to enter it into the Email This Issue app, and it will not be visible in the Azure UI later.

Step 6 - Copying data into Email This Issue

In Email This Issue go to OAuth2 credentials and click to create new credentials.

1. Name: a custom name for this entry.

2. OAuht2 Service Provider: Microsoft 0365

3. Grant type: Client Credentials

4. Client ID: the Application (client) ID - you can find it on the Overview screen

   

   The location of Client ID (aka Application ID) to copy from
5. Client Secret: this needs to be the Client Secret Value

   

   Location of the Client Secet Value to copy from
6. Auth Endpoint URL: is NOT required for this type of connection

7. Token Endpoint URL: you can find this information on the Overview page of the registered application, selecting the Endpoint menu at the top. Ensure that you copy the V2 endpoint

Location of the Token Endpoint URL to copy from

1. You do NOT need to Authorize the connection. Authorization was already completed on the Azure side at the end of Step 4.