Microsoft 365

Outlook, Teams, and OneDrive are three separate GoConva connections that share a single Azure app registration and the common Microsoft identity endpoint https://login.microsoftonline.com/common.

Register an Azure application

Create the registration

In the Azure portal, go to Microsoft Entra ID → App registrations → New registration.

Choose account types

Select Accounts in any organizational directory and personal Microsoft accounts to match the /common authority GoConva uses. Picking a single-tenant option here causes sign-in failures for outside users.

Add redirect URIs

Platform Web, then add a URI for each service you plan to connect:

https://api.yourdomain.com/connect/state

Create a client secret

Certificates & secrets → New client secret. Copy the Value immediately — Azure never shows it again.

Add Graph permissions

API permissions → Microsoft Graph → Delegated permissions. Add the scopes for the services you need, from the tables below.

Configure GoConva

One client pair serves all three, with a separate redirect per service:

MICROSOFT_CLIENT_ID=your-application-id
MICROSOFT_CLIENT_SECRET=your-client-secret
MICROSOFT_OUTLOOK_REDIRECT_URI=https://api.yourdomain.com/connect/state
MICROSOFT_TEAMS_REDIRECT_URI=https://api.yourdomain.com/connect/state
MICROSOFT_ONEDRIVE_REDIRECT_URI=https://api.yourdomain.com/connect/state

Scopes by service

All three request offline_access (for refresh tokens) and User.Read.

Outlook
Teams
OneDrive

Scope	Grants
`Mail.ReadWrite`	Read and modify mail
`Mail.Send`	Send as the user
`Calendars.ReadWrite`	Manage calendar events
`Contacts.ReadWrite`	Manage contacts

Connect with GET /connect/outlook.

Scope	Grants
`Channel.ReadWrite.All`	Read and manage channels
`ChannelMessage.Send`	Post channel messages
`ChannelMessage.Read.All`	Read channel messages
`Chat.ReadWrite`	Read and write chats
`Group.ReadWrite.All`	Manage groups and teams
`Tasks.ReadWrite`	Manage tasks

Connect with GET /connect/teams.

Group.ReadWrite.All and ChannelMessage.Read.All are high-privilege and require admin consent in most tenants. A non-admin user will see a “needs admin approval” screen — a directory administrator must grant consent once for the whole tenant.

Scope	Grants
`Files.ReadWrite.All`	Read and write all files the user can access

Connect with GET /connect/onedrive.

Connect

In your workspace, go to Settings → Integrations and click Connect on Outlook, Teams, or OneDrive. Each is its own connection, so a workspace can hold all three at once — and you can connect just the ones you need.

Troubleshooting

Symptom	Fix
`AADSTS50011` redirect mismatch	The URI is not registered on the app, or differs by scheme or trailing slash.
”Need admin approval”	A requested scope requires tenant-wide admin consent. Have an administrator grant it.
`AADSTS7000215` invalid secret	The secret expired, or the ID was copied instead of the Value.
Personal accounts cannot sign in	The registration is single-tenant but GoConva uses `/common`. Change supported account types.
Token refresh fails	`offline_access` was not consented. Reconnect.

Getting started

Integrations

Open source

Register an Azure application

Configure GoConva

Scopes by service

Connect

Troubleshooting

​Register an Azure application

​Configure GoConva

​Scopes by service

​Connect

​Troubleshooting

Register an Azure application

Configure GoConva

Scopes by service

Connect

Troubleshooting