Integration Service user guide

DELIVERY:

Automation Cloud Automation Cloud Public Sector Automation Suite

Last updated Feb 19, 2025

Microsoft Outlook 365 authentication

Prerequisites

In Integration Service, when you create a connection to one of our Microsoft Graph-based connectors, you can choose between the following authentication options:

OAuth 2.0 Authorization code – connects to the UiPath public application.
OAuth 2.0 Client credentials – uses a service account.
Bring your own OAuth 2.0 app – connects to a private application you create.

OAuth 2.0 Authorization code: your Microsoft account credentials, and, optionally, your shared mailbox.

Note:

For more details regarding the different authentication types, check How to connect to Microsoft 365 activities.

Environment

When you first access the Authentication screen, you can select an Environment. The available options are:

Office 365 (default)
US Government L4 - Public Sector domain
US Government L5 - Public Sector domain
China

For details, check Microsoft Graph and Graph Explorer service root endpoints.

Admin consent

Note: This section applies only to the OAuth 2.0 Authorization code and Bring your own OAuth 2.0 app authentication options.

Many organizations require the consent of an administrator before you create a connection to an external application. The admin consent workflow requires an admin to approve the app registration to specific users or groups before a connection is established. For more details, chek Overview of admin consent workflow and User and admin consent in Microsoft Entra ID in the Microsoft documentation.

Note:

Integration Service impersonates the user that creates the connection. The credentials of the user offer access to all of the same resources that they have in the given application. If you share the connection, every change made to Microsoft SharePoint or OneDrive with that connection is made on behalf of that user.

Scopes

The connector requests the following permissions or scopes:

OAuth 2.0 Authorization code: Mail.Read, Mail.Read.Shared, Mail.ReadWrite, Mail.ReadWrite.Shared, Mail.Send, Mail.Send.Shared, MailboxSettings.ReadWrite, Calendars.Read, Calendars.Read.Shared, Calendars.ReadWrite, Calendars.ReadWrite.Shared, profile, openid, email, offline_access, User.Read.
OAuth 2.0 Client credentials:
- Minimal scopes required for creating a connection: Mail.Read, User.Read.
Bring your own OAuth 2.0 app:
- Minimal scopes required for creating a connection: openid, offline_access, Mail.Read.
- Minimal list of scopes required for Outlook triggers:
  - openid, offline_access, Mail.Read, Mail.Read.Shared – for shared mailbox triggers.
  - Calendars.Read – for events on calendars.
  - Calendars.Read.Shared – for events on shared calendars.

Note: If you authenticate through Bring your own OAuth 2.0 app, you benefit by default from the scopes configured at app creation. If you want to use the default app permissions, declare a common scope. This means you use only the permissions configured for that application in Azure. To declare additional scopes at connection creation, use the Scopes field. Next, you are prompted to grant the additional consent during sign-in.

Add the Microsoft Outlook 365 connection

To create a connection to your Microsoft Outlook 365 instance, perform the following steps:

Select Integration Service from Automation Cloud^TM.
From the Connectors list, select Microsoft Outlook 365. You can also use the search bar to find the connector.
Select the Connect to Microsoft Outlook 365 button.
You are now redirected to the connection page.
Choose between the following authentication types: OAuth 2.0 Authorization code, OAuth Client credentials, or Bring your own OAuth 2.0 app.
- For OAuth 2.0 Authorization code, select Connect, and authenticate with your Microsoft email address and password.
  Note:
  - All Outlook activities inherit the shared mailbox you enter in the Shared mailbox field once you connect.
  - Enter your shared mailbox in the Shared mailbox field, which all Outlook activities inherit once you connect.
  - If you select OAuth 2.0 Client credentials, you must provide an Account. This represents the account used to impersonate a user.
- For Bring your own OAuth 2.0 app, you must provide a Client ID and Client secret, the Tenant ID, and the scopes required to interact with different activities. Check out the activities' documentation to learn what scopes they require.
  Note: If you use a multitenant application, keep the default value for the Tenant ID (common). If you use a single tenant application, retrieve the Tenant ID from Azure. For more details, check How to find your Microsoft Entra tenant ID.
Your connection has been added.

In case you encounter any errors during the sign-in process, it is recommended to contact your Microsoft Outlook 365 administrator.

For more information, refer to the Office 365 Outlook connector documentation.

Bring your own OAuth 2.0 app

To learn how to create an application, go to Microsoft's official documentation and follow the described steps: Register an application with the Microsoft identity platform.

Note: This is an advanced functionality and requires admin privileges in the target application. Work with your IT administrator to set up your application successfully.

Requirements

When creating your own application to use with Integration Service, you must consider the following requirements:

You must configure the application as a Multitenant or Single tenant application.
You must configure a Web application.
You must configure a Web Redirect URI. The Redirect URI (or callback URL) for your OAuth 2.0 application is provided in the authentication screen when creating a connection: https://cloud.uipath.com/provisioning_/callback.
You must set up delegated permissions. For more information, refer to Permissions in the Microsoft official documentation.
Generate a client secret for your application.

Important: The advantage of using your private OAuth application is that you can customize permissions depending on your actual needs. To learn which scopes are required for each activity in the Microsoft 365 package, refer to Working with scopes and check out the activities documentation.

The connector uses Microsoft Graph API. Refer to the Microsoft Graph permissions reference page for details on all permissions.

After you create your application, use its Client ID and Client Secret to create a connection with the Microsoft connectors.

Refresh tokens for OAuth applications

Refresh tokens for OAuth applications can be invalidated or revoked at any time by Microsoft. This can happen for different reasons, such as timeouts and revocations. For details, see Microsoft's official documentation.

Warning: Token invalidation results in failed connections and automations are unable to run without fixing connections.

Make sure to follow best practices from Microsoft when creating your OAuth applications. For full details on how to create a Microsoft OAuth app, see the Microsoft documentation.

This issue affects not only the OneDrive & SharePoint connector, but all Microsoft Graph-based connectors, such as Outlook or Teams.

On this page