Microsoft

One app registration in Microsoft Entra lets each person connect their Outlook mail and calendar, read only. Sign in with Microsoft is a separate registration, below.

Used by: OpenCRM for Outlook mail (the mail.read set).

Connect accountsCopy Anchor Link

Each person connects their own Microsoft 365 account in the Gateway, once, and every app that asks uses it. Apps never see the tokens. How connecting works

The redirect URI to register, with your Gateway's address (like apps.example.com):

https://<your gateway>/connect/microsoft-365/callback

1. Sign in to Microsoft Entra → App registrations with an account that administers your tenant, and select New registration.
2. Name it (people see the name). For Supported account types, choose any Entra ID tenant plus personal Microsoft accounts.
3. Under Redirect URI, platform Web, paste the redirect URI above, and select Register. Copy the Application (client) ID.
4. Under API permissions → Add a permission → Microsoft Graph → Delegated, add User.Read, Mail.Read and offline_access (and Calendars.Read if an app asks for calendar.read).
5. Under Certificates & secrets → New client secret, add one (24 months at most) and copy its Value right away. Note the expiry date.

Add it to your Gateway. It asks for the client ID and secret:

everyapp provider add microsoft-365

Or add it in Manage workspace → Providers.

Use it in an appCopy Anchor Link

capabilities: {
  "microsoft-365": { access: "read", scopes: ["mail.read"], why: "What the app does with it." },
},

Apps ask for these scope sets:

Check it worked: everyapp provider show microsoft-365 shows the client as set. Then open the account menu → Connected accounts → Connect Microsoft 365.

Sign in with MicrosoftCopy Anchor Link

Adds Continue with Microsoft to your Gateway's sign-in page, for people you've invited. Sign-in

1. Open entra.microsoft.com and create an App registration.
2. Add the redirect URL https://<your gateway>/api/auth/callback/microsoft.
3. Copy:
   • MICROSOFT_SIGNIN_CLIENT_ID: The app registration's Application (client) ID.
   • MICROSOFT_SIGNIN_CLIENT_SECRET: A client secret from Certificates & secrets (it expires; 24 months at most)

• Without MICROSOFT_SIGNIN_TENANT, add the optional claims email and xms_edov under Token configuration, or every sign-in is refused as unverified: any tenant's admin can put any address on their users.

Optional: MICROSOFT_SIGNIN_TENANT, The Directory (tenant) ID to pin sign-in to your own directory; unset means any Microsoft account (common), which then needs the xms_edov claim.

Turn it on. It asks for each value:

everyapp signin add microsoft

Check it worked: everyapp signin show microsoft shows each setting as set. Then sign out and select the button.

More helpCopy Anchor Link

Ask your coding agent to set Microsoft up: the everyapp skill has the full guide (setup/microsoft-365.md, setup/signin-microsoft.md).

Something wrong or missing? Open an issue.