# Office 365 OAuth setup

In order to connect Office 365 accounts to Aurinko through OAuth2 authentication you'll need to register your app in Azure Active Directory (AAD). You will then configure Aurinko to use your AAD application Id. If you have any trouble registering your application in Azure AD, get in touch with  [support@aurinko.io](mailto:mailto:support@aurinko.io) and we'd be happy to help you out!

Create your [free Microsoft Azure](https://azure.microsoft.com/en-us/free/) account if you don't already have one. You'll use this account to create the Microsoft developer application that is used for authenticating end users via OAuth with Aurinko.

### **Creating an app registration**

***

The first step is to create an app that will be used to authenticate your customers to Office365. To do that we're going to use the Azure web portal. Log into [https://portal.azure.com](https://portal.azure.com/) and go to Azure Active Directory service.

<div data-full-width="true"><figure><img src="https://s3.amazonaws.com/helpscout.net/docs/assets/5dd72e4d2c7d3a7e9ae44753/images/5e0a599c2c7d3a7e9ae59c8f/file-ITfUR7SGeL.jpg" alt=""><figcaption></figcaption></figure></div>

Then click **"New Registration"**.

<div data-full-width="true"><figure><img src="https://s3.amazonaws.com/helpscout.net/docs/assets/5dd72e4d2c7d3a7e9ae44753/images/5e0a653a04286364bc9353d1/file-t9ttrT40ax.jpg" alt=""><figcaption></figcaption></figure></div>

You are going to be presented with the following screen. Set your name to your app's name (this is going to be customer visible). Set the audience for this app to *"Account in any organizational directory and personal Microsoft accounts"* to be able to log into any Office 365 account (business and personal). You can also restrict it to internal accounts (*"Accounts in this organizational directory only"*) if you're building an internal app. Then, specify a redirect URI, read [this article](https://docs.aurinko.io/authentication/authorized-return-urls) for more information.

<div data-full-width="true"><figure><img src="https://s3.amazonaws.com/helpscout.net/docs/assets/5dd72e4d2c7d3a7e9ae44753/images/5e0a66082c7d3a7e9ae59d04/file-J6s0cfrZes.jpg" alt=""><figcaption></figcaption></figure></div>

Congrats, you've just registered your app!&#x20;

<div data-full-width="true"><figure><img src="https://s3.amazonaws.com/helpscout.net/docs/assets/5dd72e4d2c7d3a7e9ae44753/images/5e0a689d04286364bc9353f4/file-eR3USqoRZN.jpg" alt=""><figcaption></figcaption></figure></div>

### **Specifying API permissions**

***

Now, let's make sure your app has the right API permissions. To do that, head to the "API permissions" panel and click **"Add a permission".**

<div data-full-width="true"><figure><img src="https://s3.amazonaws.com/helpscout.net/docs/assets/5dd72e4d2c7d3a7e9ae44753/images/5e0a6b7204286364bc935407/file-dQ5KNyNmPw.jpg" alt=""><figcaption></figcaption></figure></div>

Choose Microsoft Graph set of permissions

<div data-full-width="true"><figure><img src="https://s3.amazonaws.com/helpscout.net/docs/assets/5dd72e4d2c7d3a7e9ae44753/images/5e0a6c0a2c7d3a7e9ae59d4e/file-FOAuckn1fN.jpg" alt=""><figcaption></figcaption></figure></div>

You'll need to determine what Graph API permissions you add to your consent screen based on your application's behavior. Please reference this mapping to see how Aurinko scopes will map to Graph API permissions during the [authentication](https://docs.aurinko.io/authentication/oauth-flow) process:

| Aurinko scope        | Graph API permission  |
| -------------------- | --------------------- |
| `Mail.ReadOnly`      | `Mail.Read`           |
| `Mail.ReadWrite`     | `Mail.ReadWrite`      |
| `Mail.Draft`         | `Mail.ReadWrite`      |
| `Mail.Send`          | `Mail.Send`           |
| `Calendar.ReadOnly`  | `Calendars.Read`      |
| `Calendar.ReadWrite` | `Calendars.ReadWrite` |
| `Contacts.ReadOnly`  | `Contacts.Read`       |
| `Contacts.ReadWrite` | `Contacts.ReadWrite`  |
| `Tasks.ReadOnly`     | `Tasks.Read`          |
| `Tasks.ReadWrite`    | `Tasks.ReadWrite`     |

Then add all required **Delegated permissions**, i.e. <mark style="color:red;">`Calendars.ReadWrite`</mark>, <mark style="color:red;">`Contacts.ReadWrite`</mark>, <mark style="color:red;">`Mail.ReadWrite`</mark>, <mark style="color:red;">`Mail.Send`</mark>, <mark style="color:red;">`Tasks.ReadWrite`</mark>.

Additionally, ensure that the application is configured with the following OAuth scopes: <mark style="color:red;">`offline_access`</mark>, <mark style="color:red;">`openid`</mark>, <mark style="color:red;">`email`</mark>, <mark style="color:red;">`profile`</mark>, <mark style="color:red;">`MailboxSettings.Read`</mark>, <mark style="color:red;">`User.Read`</mark>.

{% hint style="warning" %}
Aurinko requests these permissions implicitly.
{% endhint %}

<figure><img src="https://3933352743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0ua36KLVlbUN5bA2bgiq%2Fuploads%2FIJbHHGdq8Vc16bZXpHVk%2Fimage.png?alt=media&#x26;token=490c8c9d-7d8b-4eff-bf4f-72748878b3f7" alt=""><figcaption></figcaption></figure>

This is what your application permissions screen should look like

<div data-full-width="true"><figure><img src="https://s3.amazonaws.com/helpscout.net/docs/assets/5dd72e4d2c7d3a7e9ae44753/images/5e0a700e04286364bc93542d/file-OhDnYluRmu.jpg" alt=""><figcaption></figcaption></figure></div>

### **Creating OAuth credentials**

***

Head to the "Certificates & secrets" panel and click **"New client secret".**

<div data-full-width="true"><figure><img src="https://s3.amazonaws.com/helpscout.net/docs/assets/5dd72e4d2c7d3a7e9ae44753/images/5e0a70d004286364bc935434/file-ugh5uDSCm2.jpg" alt=""><figcaption></figcaption></figure></div>

Give the secret a name and an expiration date of "never", then click **"Add"**.

<div data-full-width="true"><figure><img src="https://s3.amazonaws.com/helpscout.net/docs/assets/5dd72e4d2c7d3a7e9ae44753/images/5e0a71af2c7d3a7e9ae59d8a/file-vrUoKPtMCg.jpg" alt=""><figcaption></figcaption></figure></div>

Copy the secret somewhere safe. You won't be able to retrieve it from this page afterwards!

<div data-full-width="true"><figure><img src="https://s3.amazonaws.com/helpscout.net/docs/assets/5dd72e4d2c7d3a7e9ae44753/images/5e0a72522c7d3a7e9ae59d94/file-cX1og6NWw1.jpg" alt=""><figcaption></figcaption></figure></div>

Finally, copy the app id and secret and upload them to the Aurinko portal.

### **Configure Aurinko to use your Office 365 OAuth credentials**

***

Head on over to [Aurinko portal](https://app.aurinko.io/) and log in.

Select your app at the top, choose Settings menu and switch to the OFFICE 365 tab.

<div data-full-width="true"><figure><img src="https://3933352743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0ua36KLVlbUN5bA2bgiq%2Fuploads%2FMz6sa7LSkOwCOLFnakV4%2Fimage.png?alt=media&#x26;token=ef8e16a6-ae27-4da2-be70-bba9bbfe4d43" alt=""><figcaption></figcaption></figure></div>

Copy-paste your Azure AD OAuth Client ID and Secret from the Azure AD app page and click "Save".

**You are now all set to start connecting Office 365 accounts to Aurinko!**