Three features share one set of credentials: the Microsoft integrations, the
Outlook triggers, and e-mail campaigns. None of them is available until the app
registration exists.
Variables
Creating the registration
- Microsoft Entra admin center → App registrations → New registration.
- Supported account types: Accounts in any organizational directory and
personal Microsoft accounts unless you mean to restrict it.
- Redirect URI, platform Web:
https://your-host/integrations/microsoft/callback.
It must match MICROSOFT_INTEGRATION_REDIRECT_URI character for character —
a trailing slash is a different URI.
- Certificates & secrets → New client secret. Copy the Value column
immediately; it is shown once, and the Secret ID is not the secret.
- API permissions → Microsoft Graph → Delegated, then grant consent:
offline_access, User.Read, Mail.Read, Mail.Send,
Files.ReadWrite.All, Calendars.ReadWrite, Chat.Read.
Client secrets expire — six or twenty-four months, chosen at creation.
When one expires, every connected integration stops refreshing its token and
users are asked to reconnect, with no other symptom. Note the date somewhere
that will outlive the session that created it.
Check
Restart the backend, then Integrations → Outlook → Connect. The consent
screen means the registration is right; an AADSTS error names what is wrong —
usually the redirect URI. 
