Microsoft OAuth2 credentials

Fields

Field	Type	Required	Notes
Access Token accessToken	password	Yes	Microsoft OAuth2 access token
Refresh Token refreshToken	password	No	Microsoft OAuth2 refresh token for automatic renewal
Client ID clientId	string	No	Microsoft Azure AD application client ID
Client Secret clientSecret	password	No	Microsoft Azure AD application client secret
Tenant ID tenantId	string	No	Azure AD tenant ID (use "common" for multi-tenant)
Graph API Base URL graphApiBaseUrl	string	No	Microsoft Graph API base URL (change for sovereign clouds)
Use Shared Mailbox useShared	boolean	No	Access a shared mailbox instead of the user mailbox (Outlook)
User Principal Name userPrincipalName	string	No	Target user UPN or ID for shared mailbox access (Outlook)
Token Expiry (Unix timestamp) expiresAt	string	No	Unix timestamp (seconds) when the access token expires. Managed automatically after refresh.

Getting your credentials

1. In the Azure portal, open Microsoft Entra ID (formerly Azure Active Directory) and register a new application.
2. Note the application’s Client ID and the Tenant ID. Use common as the tenant for a multi-tenant application.
3. Create a client secret for the application and copy its value immediately — it is shown only once.
4. Add the Microsoft Graph delegated permissions the nodes you plan to use require, and grant admin consent if your tenant requires it.
5. Complete the OAuth2 authorisation flow so the credential holds an access token and a refresh token. The refresh token is what keeps the connection working without re-authorising.

Permissions and scopes

Grant only the Graph permissions the operations need — mail, files or sites as applicable. Over-permissioning an automation application is a common audit finding and rarely necessary.

For shared mailbox access in Outlook, enable Use Shared and set User Principal Name to the mailbox to target. The signed-in identity must already have delegated access to that mailbox in Exchange.

Sovereign clouds use a different Graph endpoint — set Graph API Base URL accordingly if you are not on the global cloud.

Troubleshooting

• Token expired and not refreshing — the refresh token is missing or was revoked. Re-run the authorisation so a new one is stored; expiresAt is managed automatically.
• 403 with insufficient privileges — the required Graph permission was not granted, or admin consent is outstanding for the tenant.
• Shared mailbox access denied — the authenticated user does not have delegated rights to that mailbox in Exchange. Grant them there first.
• Endpoints not found — check Graph API Base URL if you are on a sovereign or government cloud.