Microsoft 365 and Graph connections
Microsoft Graph access has two connection types in Stackyapper. Microsoft 365
uses a person’s signed-in work account. Microsoft Graph (application) uses an
organization’s Entra application and administrator-approved application permissions.
Both remain Beta.
The built-in Microsoft 365 personal sign-in is currently disabled. The workload
guide below describes its setup when that connection is enabled. An available
application connection has separate credentials and does not enable personal
sign-in.
Choose the connection type
| Connection | Who connects it | Microsoft access |
| Microsoft 365 | Each person connects their own work account, when available | Delegated permissions: the signed-in person’s Microsoft access and the permissions they approve |
| Microsoft Graph (application) | A Stackyapper workspace owner or administrator | Application permissions approved in Entra for one organization’s application |
Connecting an app does not grant everyone in the workspace access to its tools.
Choose the required tools in Tools & access. Stackyapper checks the workspace
and user’s access before each request. See Understand access.
Choose workloads
The personal connection has 27 workload choices in six groups. Each choice selects
specific read tasks; it does not enable every Microsoft API in that area. The
application connection offers the 20 choices marked Yes below.
| Workload | Read tasks | Application connection |
| Profile | Your account profile | Personal only |
| My Graph Operations | The selected personal tasks below | Personal only |
| Outlook Mail | Messages and mail folders | Yes |
| Outlook Calendar | Events and events in a date range | Yes |
| Outlook Contacts | A contact | Yes |
| To Do Tasks | A task list or task | Yes |
| Planner | A plan | Yes |
| OneDrive Files | A file or the children of a folder | Yes |
| Excel Workbooks | A worksheet’s details | Personal only |
| SharePoint Sites | A site or SharePoint list | Yes |
| OneNote | A notebook | Personal only |
| Teams Chats | Chats and chat messages | Personal only |
| Teams Channels | A channel’s name and membership type | Yes |
| Meetings and Calls | An online meeting’s details | Personal only |
| Users | A user | Yes |
| Groups | A group | Yes |
| Directory | A directory object | Yes |
| Applications | An application registration | Yes |
| Identity and Governance | A Conditional Access policy | Yes |
| Admin and Reports | Organization details or a directory audit record | Yes |
| Security and Compliance | Security alerts or retention labels | Yes, alerts only |
| Devices and Intune | A managed device | Yes |
| Education | A school | Yes |
| Microsoft Search | A small, complete file search | Personal only |
| External Connections | An external connection | Yes |
| Solutions and Employee Experience | A Bookings business | Yes |
| Platform Services | A place or printer | Yes |
The groups are Productivity, Files and content, Collaboration, Directory and
identity, Administration and security, and Platform and business.
The personal connection initially selects mail, calendar and files. Account
identity is always included. Add only the workloads needed for the next task;
new workloads do not expand an existing account’s permissions until you reconnect
and approve the additional access.
Open Individual permissions and write access to review the specific permissions
or choose separately available write tools. Write access is not selected by default.
The Excel worksheet read is an exception in Microsoft’s permission model: it
requires
Files.ReadWrite, which grants broader file access even though the
Stackyapper worksheet task only reads details. Review that permission before selecting
Excel Workbooks or My Graph Operations.Some choices require a Stackyapper workspace owner or administrator. Microsoft may
also require administrator consent, an eligible Microsoft role or a product license.
Those are separate requirements. Intune device access, for example, requires an
active Intune license.
Connect a personal account when enabled
- Open Apps, select Microsoft 365, then Connect account or Manage accounts.
- Select the workloads you need under Choose Microsoft 365 access.
- Review the permissions, choose Continue to Microsoft, and sign in with the intended work account.
- Review Microsoft’s consent screen and approve only the intended access.
- Start with a small read task and confirm the selected account and result in Audit.
Each account keeps its own authorization. Connecting one person does not authorize
another person or every Microsoft tenant. Stackyapper stores the authorization
encrypted and does not ask for your Microsoft password.
Use Reconnect with selected access to add access to a connected account. Previously approved
permissions remain selected. To reduce access, disconnect that account and
connect it again with the smaller selection. If several accounts can run the task,
identify the intended connection; Stackyapper does not silently substitute another.
Configure an application connection
If Microsoft Graph (application) is available in your workspace:
- In Microsoft Entra, use an application owned by the intended organization.
- Add only the Microsoft Graph application permissions needed for the selected tasks, using the table below. Have an authorized Microsoft administrator grant consent.
- Record the organization’s Directory (tenant) ID and the application’s Application (client) ID, then create a client secret.
- In Stackyapper, open Apps → Microsoft Graph (application) as a workspace owner or administrator.
- Enter Microsoft tenant ID, Application client ID and Application client secret. Select the Microsoft Graph workloads to allow, then save.
- Grant users or groups the required tools in Tools & access.
- Test one selected read task for a known record and confirm the result in Audit.
The tenant and application IDs must be UUIDs from Entra. Stackyapper stores the
secret encrypted and requests tokens for that exact tenant. Selecting a workload
in Stackyapper does not grant its Microsoft permissions or approve other workloads.
For user-specific application reads, provide the intended Microsoft user’s object
ID; application connections have no signed-in “me” account.
Application permission prerequisites
| Workload | Microsoft Graph application permissions for the reviewed reads |
| Outlook Mail | Mail.Read |
| Outlook Calendar | Calendars.Read |
| Outlook Contacts | Contacts.Read |
| To Do Tasks | Tasks.Read.All |
| Planner | Tasks.Read.All |
| OneDrive Files | Files.Read.All |
| SharePoint Sites | Sites.Read.All |
| Teams Channels | Channel.ReadBasic.All |
| Users | User.Read.All |
| Groups | GroupMember.Read.All |
| Directory | Directory.Read.All |
| Applications | Application.Read.All |
| Identity and Governance | Policy.Read.All |
| Admin and Reports | Organization.Read.All and AuditLog.Read.All and Directory.Read.All |
| Security and Compliance | SecurityAlert.Read.All |
| Devices and Intune | DeviceManagementManagedDevices.Read.All |
| Education | EduRoster.Read.All |
| External Connections | ExternalConnection.Read.All |
| Solutions and Employee Experience | Bookings.Read.All |
| Platform Services | Place.Read.All and Printer.Read.All |
Admin and Reports directory-audit reads require both
AuditLog.Read.All and
Directory.Read.All. Organization details use Organization.Read.All.
Platform Services has separate place and printer reads; approve only the
permissions for the reads you intend to use.Application access is unavailable for Profile, My Graph Operations, Excel
Workbooks, OneNote, Teams Chats, Meetings and Calls, and Microsoft Search.
Microsoft retired OneNote application authentication
in March 2025; OneNote remains a personal-account task. Retention-label reads are
also personal-only. Security and Compliance application access covers the reviewed
security-alert reads.
Check a selected task
Many tasks need a known record ID, such as a plan, device, school or Bookings
business. They read that record’s details rather than enumerate the whole area.
If setup asks you to verify a selected task, use its intended record ID; the
connection will not test an unrelated workload by adding permissions for it.
List tasks return at most 50 records per request. Where another page is available,
use the returned continuation to retrieve it. Microsoft Search supports file
queries that fit within a single complete response of at most 50 hits. If Microsoft
reports more results, narrow the query and try again; Stackyapper does not return
a partial search as complete.
If access fails
Check the selected connection, tenant, workload and record ID first. For a personal
connection, reconnect if the needed permission is missing or Microsoft revoked the
grant. For an application connection, check the application permissions and
administrator consent in Entra, then update an expired secret in Stackyapper.
A Microsoft permission does not replace the signed-in person’s role, workspace
tool grants or a required Microsoft product license. If the app is unavailable,
use the portal’s request-access option or contact your workspace administrator.
Do not send secrets or Microsoft sign-in values when requesting support.