Skip to main content
The Microsoft 365 integration lets Sofie work with Microsoft email, calendar, OneDrive, and SharePoint when your organization enables it and a user connects their account. Use this guide if you administer Microsoft Entra apps for your organization or need to understand what your Microsoft admin must configure.
Your organization may use Sofie-managed OAuth configuration or your own Microsoft Entra app. Follow the option shown in Organization Settings.
Microsoft Entra ID can also be used for Sofie sign-in. Use Microsoft SSO for sign-in setup. Configure Microsoft 365 data access under Organization Settings > Integrations.

​
What Sofie can use

Depending on permissions and user consent, Sofie may use Microsoft 365 to:
  • Search and read email.
  • Draft and send email after review.
  • Read calendar events.
  • Create or update calendar events after review.
  • Search OneDrive and SharePoint files.
  • Import useful files into a Workspace.
  • Use file context in chat when available.

​
Before you start

You need:
  • Microsoft Entra administrator access.
  • Permission to register or manage an app registration.
  • The Sofie domain your users sign in to.
  • Access to Sofie Organization Settings > Integrations.
  • Agreement on which Microsoft capabilities users need.

​
Redirect URI

Add this redirect URI to the Microsoft app registration, replacing the domain with your Sofie domain:
Use the exact production domain users open in the browser. If your Sofie deployment has separate staging and production domains, add each environment separately. If you already created a Microsoft app registration for Microsoft SSO, you can add this integration redirect URI to that same app registration instead of creating a second app.
Use one app registration when the same Microsoft tenant, IT owner, consent process, and secret rotation policy apply to both Sofie sign-in and Microsoft 365 data access. Use separate app registrations when your organization wants separate review, consent, audit ownership, or secret rotation.

​
Register the Microsoft app

1

Open Microsoft Entra admin center

Go to Microsoft Entra admin center and open App registrations.
2

Create a new registration

Click New registration. Use a clear name such as Sofie Microsoft 365 Integration.
3

Choose supported account types

Choose the account type your organization allows. Most customer deployments use accounts in the organization tenant only.
4

Add a web redirect URI

Choose Web and add https://<your-sofie-domain>/api/integrations/callback/microsoft.
5

Save the application

Save the app registration.
Microsoft reference: Register an application with the Microsoft identity platform.

​
Create credentials

1

Open Certificates & secrets

In the app registration, open Certificates & secrets.
2

Create a client secret

Create a new client secret with an expiration that matches your organization policy.
3

Copy the value once

Copy the secret value immediately. Microsoft does not show the full value later.
4

Store it in Sofie

Enter the client secret only in the secure Microsoft integration fields in Sofie.
Microsoft reference: Add credentials to an application.
Do not paste client secrets into chat, CoDrafts, Workspaces, screenshots, or public docs. Use the secure integration settings fields only.

​
Configure Microsoft Graph permissions

Sofie’s Microsoft integration requests the following fixed set of scopes when a user connects their account: Configure the Microsoft Graph permissions as Delegated permissions, not Application permissions. Delegated access does not give Sofie access beyond what the signed-in user can access. Microsoft reference: Microsoft Graph permissions reference.
These scopes are fixed in the current Sofie integration flow. Sofie requests and checks for the complete set when a user connects Microsoft. Reducing the requested permissions requires a corresponding change to Sofie’s integration configuration.

​
Use the SSO app registration

When your organization uses the same Microsoft app registration for SSO and Microsoft 365 integration:
  • Configure the complete combined scope set in Permissions for a shared app registration.
  • In Sofie Organization Settings > Integrations > Microsoft, use the same client ID, tenant ID, and client secret value if Sofie asks for a custom OAuth app.
  • Test sign-in first, then test a user Microsoft connection and review the consent prompt.
Microsoft SSO and Microsoft 365 integration are still separate Sofie features. Enabling SSO lets users sign in with Microsoft. Enabling the Microsoft integration lets users connect Microsoft 365 sources such as email, calendar, OneDrive, and SharePoint.
For the full combined workflow, see Set up SSO first, then integration.

​
Add values in Sofie

In Sofie, go to Organization Settings > Integrations and open Microsoft. Enter: Then enable Microsoft and save settings.

​
Configure Microsoft sign-in policy

If your organization uses Microsoft Entra ID for Sofie sign-in, follow Microsoft SSO. After Microsoft sign-in is configured, review Disable magic links when SSO is enabled in Authentication Policy. Turning it on hides and blocks email magic-link sign-in while Microsoft SSO is enabled and fully configured. Magic links stay available if no SSO provider is enabled.

​
Test the connection

1

Connect a test user

Use a user account with representative but limited Microsoft access.
2

Review consent

Confirm the consent screen lists the expected Microsoft permissions.
3

Test read actions

Ask Sofie to search email, calendar, OneDrive, or SharePoint content that the test user can access.
4

Test write actions carefully

If enabled, test email send or calendar creation with safe recipients and test events.
5

Import a file

Search OneDrive or SharePoint and import a test file into a Workspace if that workflow is enabled.

​
User prompt examples

​
Troubleshooting

Confirm Microsoft is enabled in Sofie, the redirect URI matches exactly, the app registration has a valid client secret, and user consent is allowed by your Microsoft tenant policy.
Check whether the Microsoft app has send permissions, whether admin consent is required, and whether the user has permission to send from the mailbox.
Confirm the user can open the site directly in Microsoft 365. Then check whether the integration includes the SharePoint-related permissions your organization allows.
Check whether the client secret expired, the app registration changed, or your organization changed conditional access or consent policies.

​
Official Microsoft references