Authentication User Credentials

Description

Use delegated access (User Credentials) whenever you want to let a signed-in user work with their own resources or resources they can access. Whether it's an admin setting up policies for their entire organization or a user deleting an email in their inbox, all scenarios involving user actions should use delegated access. [API reference]

Instructions

Follow these simple steps below to create Microsoft Entra ID application with delegated access:

1. Navigate to the Azure Portal and log in using your credentials.
2. Access Microsoft Entra ID.

3. Register a new application by going to App registrations and clicking on New registration button:

   
   INFO: Find more information on how to register an application in Graph API reference.

4. When configuration window opens, configure these fields:

   • Supported account type
     • Use Accounts in this organizational directory only, if you need access to data in your organization only.
   • Redirect URI:
     • Set the type to Public client/native (mobile & desktop).
     • Use https://zappysys.com/oauth as the URL.
   

5. After registering the app, copy the Application (client) ID for later:

   

6. Then copy OAuth authorization endpoint (v2) & OAuth token endpoint (v2) URLs to use later in the configuration:

   

7. Now go to SSIS package or ODBC data source and use the copied values in User Credentials authentication configuration:

   • In the Authorization URL field paste the OAuth authorization endpoint (v2) URL value you copied in the previous step.
   • In the Token URL field paste the OAuth token endpoint (v2) URL value you copied in the previous step.
   • In the Client ID field paste the Application (client) ID value you copied in the previous step.
   • In the Permissions (Scope) field use the default or pick labeled permissions. [System] covers sign-in and refresh token. [User] is the signed-in user’s mailbox (use Mail.ReadBasic or Mail.Read for read-only). [Shared] adds shared or delegated mail folders. [Tenant] entries (User.ReadBasic.All, User.Read.All, Group.Read.All) are broad directory permissions that usually need an administrator to approve the app. The default includes User.ReadBasic.All for the Default User Id drop down; add User.Read.All only if you need full user profiles (not required for listing users).
     • offline_access, openid, profile, email
     • User.Read, Mail.ReadBasic, Mail.Read, Mail.ReadWrite, Mail.Send
     • Mail.Read.Shared, Mail.ReadBasic.Shared, Mail.ReadWrite.Shared, Mail.Send.Shared
     • User.ReadBasic.All, Group.Read.All (often admin consent; user drop down / group lookups)
     • User.Read.All (optional — full user profiles; broader than needed for user drop down)
     Admin consent note:

     • Token generation can still ask for admin approval, even when delegated scopes are listed in API permissions.
     • A Global Administrator can allow user consent for selected low-impact delegated permissions.
     • Broad mail or directory scopes such as Mail.ReadWrite, User.ReadBasic.All, User.Read.All, and Group.Read.All may still require admin consent.

     Settings: User consent settings (Entra ID > Enterprise apps > Consent and permissions > User consent settings). Docs: configure user consent, recommended settings.
8. Press Generate Token button to generate Access and Refresh Tokens.

9. Choose Default User Id from the drop down menu after token generation. This calls GET /users and requires User.ReadBasic.All in your token (included in the default scope list). Regenerate the token if you add or remove this scope later. Keep me for your own mailbox, or pick another user when accessing a shared or delegated mailbox. You can also type a user id or email manually if listing fails.

10. Click Test Connection to confirm the connection is working.
11. Done! Now you are ready to use the API Connector!

Parameters