Microsoft 365 · Graph
Microsoft 365 integration in your own system
Microsoft 365 integration means your app talks to your customers’ tenant via Microsoft Graph: identity, Outlook, OneDrive, SharePoint, Teams — with the scopes you actually need. It is the right door when the company already lives in 365. Then you should not build a new file archive and a new calendar. You should build the case, and let 365 be file and meeting. Scopes are the product. User.Read is not the same as Mail.ReadWrite and Files.ReadWrite.All. Each permission must be explainable to an IT owner. “We took tenant-wide admin consent to be safe” is how projects die in security review. In B2B products, admin onboarding is the integration for many customers.
Sub-pages when you only need one piece: Outlook, Teams, SharePoint, OneDrive. If you live in Google instead, that is Google Workspace. Automation on top of what you already pay for.
Scopes are the product
Each permission is a sentence you must be able to say out loud in a security meeting. If you cannot, the scope does not belong in version 1.
Scopes that typically hold
- User.Read for “who are you”
- Calendars.ReadWrite when you book on behalf of the user
- Sites.Selected instead of the whole tenant
Scopes that kill review
- Mail.ReadWrite “because we might need it”
- Files.ReadWrite.All on the whole tenant
- Tenant-wide admin consent without onboarding
Admin consent is onboarding
App registration
Single-tenant if the app is only for you. Multi if the product must enter customers’ 365.
Consent
A tenant admin approves the scopes you wrote down.
First case
Create a meeting, put a file, post in Teams — one flow, not every Graph endpoint.
What to do now
Write the three actions the case should trigger in 365 — meeting, file, message. Not “full Graph”. Then we can price the scopes. Packages.
FAQ about Microsoft 365 integration
Single tenant or multi-tenant app?
Single if the app is only for you. Multi if your product must enter customers’ 365. That choice must be made before the first login screen.
Must IT approve the app?
In B2B typically yes. Build that onboarding. It is the integration for many customers — not the API call.
Can we take Files.ReadWrite.All “to be safe”?
No. That is how projects die in security review. Sites.Selected or one library.
Is Graph one project or five?
One hub, several sub-pages. Outlook, Teams, SharePoint and OneDrive are each their own scope conversation.
What if the customer is on Google?
Then you build Workspace, not 365. Two stacks in the same SME is a project you should talk them out of.