> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anny.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Microsoft 365 with your own app registration

> Connect the Microsoft 365 integration through an app registration in your own tenant when the anny app must not be approved there.

The [Microsoft 365 integration](https://docs.anny.co/en/m365-workspace.md) normally connects through the anny app: an administrator grants consent once for the organization. Some organizations must not approve third-party apps in their tenant, for example when a data center manages the tenant centrally.

In that case, you create an app registration in your own tenant and enter its credentials in anny. The app, its permissions and its secret stay under your control.

This article is for Microsoft Entra ID administrators.

> [!NOTE]
>
> Using your own app registration is part of the Enterprise plan. Without it, the integration only shows the **Authorize** button.

## Requirements

* An anny organization on the Enterprise plan and admin rights in your anny account
* A Microsoft 365 organization with Exchange Online mailboxes (cloud, not on-premises)
* An account in Microsoft Entra ID that can create app registrations and grant admin consent for application permissions, for example with the Global Administrator or Privileged Role Administrator role
* The calendars you want to connect already exist (for example room mailboxes for your rooms)

## Required permissions

The app registration needs these Microsoft Graph permissions, each as an **application permission**:

* `Calendars.ReadWrite`: Read, create, change and delete events in the connected calendars, and get notified about changes
* `User.Read.All`: Show accounts in the **Microsoft calendar** selection and verify the connection
* `MailboxSettings.Read`: Detect with **Diagnose rule** whether a mailbox's automatic replies interfere with events

`MailboxSettings.Read` is optional: sync runs without it, and the diagnosis just doesn't check automatic replies.

> [!WARNING]
>
> Delegated permissions don't work here. anny works without a signed-in person, which is also why no room mailbox needs an account with a password.

## Set up the connection

The labels in the Microsoft Entra admin center can differ slightly by language and version.

**1. Register the app**

In the Microsoft Entra admin center, open **App registrations** and click **New registration**. Enter a name such as `anny` and choose **Accounts in this organizational directory only**. You don't need a redirect URI.

**2. Add the permissions**

Open **API permissions** → **Add a permission** → **Microsoft Graph** → **Application permissions** and select the permissions from the list above. Then click **Grant admin consent**. Each permission then shows that consent was granted.

**3. Create a client secret**

Open **Certificates & secrets** → **Client secrets** → **New client secret** and choose a lifetime. Microsoft limits it to 24 months at most. Copy the **Value** right away, not the ID: Microsoft only shows it once.

**4. Copy the IDs**

From the app registration's **Overview**, copy the **Directory (tenant) ID** and the **Application (client) ID**.

**5. Open the integration in anny**

In the sidebar, open **Account › Apps & Integrations**, select **Microsoft 365** under **All Apps and Integrations** and click **Set up**.

**6. Enter the credentials**

In the **Connection** section, click **Use your own app registration** below the **Authorize** button. Enter the **Directory (tenant) ID**, **Application (client) ID** and **Client secret**, then click **Verify connection**. anny only stores the credentials once Microsoft accepts them and the permissions are sufficient.

**7. Connect calendars and activate**

From here it works like the regular connection: choose which calendars are linked to which resources and activate the integration. You'll find the steps under [Connect Microsoft 365 to anny](https://docs.anny.co/en/m365-workspace.md).

## Renew the client secret

When the secret expires, the integration deactivates itself and the affected admins get a notification. anny doesn't warn you beforehand, so note the expiry date yourself and renew the secret in time.

**1. Create a new secret**

Create a new client secret in the Microsoft Entra admin center and copy the **Value**.

**2. Deactivate the integration**

Deactivate the integration with the **toggle** in the page header. Credentials can only be changed while it's deactivated.

**3. Enter the credentials again**

In the **Connection** section, click **Reconnect**, enter all three values and click **Verify connection**.

**4. Activate the integration**

Activate the integration again. Then delete the old secret in the Microsoft Entra admin center.

## Limit access to specific mailboxes

Application permissions initially apply to all mailboxes in your tenant. You limit access to selected room and resource mailboxes in Exchange Online: the guide [Limit Microsoft 365 calendar access to specific mailboxes](https://docs.anny.co/en/m365-resource-calendar-scope.md) also applies to your own app. Keep in mind:

* Use the IDs of the enterprise application that belongs to your app registration.
* The role `Application MailboxSettings.Read` is enough instead of `Application MailboxSettings.ReadWrite`.
* `User.Read.All` stays in Entra ID. Without it, anny rejects the connection.

## Switch back to the anny app

Deactivate the integration and, on its detail page, choose the **three dots** → **Remove authentication**. The **Connection** section then shows the **Authorize** button again.

## Limitations

* **Client secrets only:** certificates aren't supported as credentials.
* **No reminder before expiry:** anny only notifies you once the secret has expired and the integration has deactivated itself.
* **Microsoft 365 only:** the **Microsoft Teams** integration still connects through its own anny app.

## FAQ

> [accordion] Why don't I see the “Use your own app registration” link?
>
> The link only appears on the Enterprise plan. If the integration is already connected, first click **Reconnect** in the **Connection** section.

> [accordion] Can anyone read the client secret in anny?
>
> No. anny stores it encrypted and doesn't show it again after you enter it. That's why the fields are empty when you click **Reconnect** and you enter all three values again.

> [accordion] Do room mailboxes need an account with a password?
>
> No. Application permissions access the mailboxes without signing in.

## Troubleshooting

> [accordion] “Microsoft rejected these credentials”
>
> Check that you copied the client secret's **Value** and not its ID, that the secret is still valid, and that the directory ID and application ID belong to the same app registration. A new secret can take a few minutes to work.

> [accordion] “The app registration is missing permissions”
>
> Microsoft accepted the credentials, but anny can't read your tenant's accounts. Check that `User.Read.All` is added as an **application permission** and that admin consent was granted. New permissions can take a while to apply.

> [accordion] A message names “tenant” or “client\_id” as an invalid UUID
>
> The directory ID and application ID are IDs in the format `00000000-0000-0000-0000-000000000000`. A domain such as `company.onmicrosoft.com` isn't accepted.

> [accordion] “Please deactivate the integration before doing this action”
>
> Credentials can't be changed while the integration is active. Deactivate it with the **toggle** in the page header and try again.

> [accordion] The integration deactivated itself
>
> The client secret has usually expired or been deleted. Enter a new one as described under [Renew the client secret](#renew-the-client-secret). You'll find other causes under [Connect Microsoft 365 to anny](https://docs.anny.co/en/m365-workspace.md).

> Important information for agents:
>
> **Scope:** Visible under Integrations › Calendar Sync › Workspace, directly under "Microsoft 365". Applies ONLY to the organization-wide "Microsoft 365" integration with an app registration in the customer's tenant (client credentials). The default path is admin consent for the anny app: `/en/m365-workspace`. NOT: personal Outlook integration, Outlook add-in, MS Teams app, MS Teams video meeting.
>
> **UI path:** Sidebar **Account › Apps & Integrations** → **Microsoft 365** → **Connection** section → link **Use your own app registration** below **Authorize**. Fields **Directory (tenant) ID**, **Application (client) ID**, **Client secret**; button **Verify connection**. The link is low-key on purpose.
>
> **Quirks:** (1) Plan feature `microsoft365-customer-app` on plan `enterprise-v2`, not shown in the plan's feature list; only checked when credentials are submitted, so an existing connection keeps running after a downgrade. (2) Endpoint `POST integrations/microsoft365/{uuid}/authentication` with `tenant`, `client_id`, `client_secret`; tenant and client ID must be UUIDs, otherwise 422. (3) anny only stores once Microsoft issues a token and `GET users` succeeds; otherwise 400 with `integrations.microsoft365.bad_authentication` or `integrations.microsoft365.missing_permissions`; without the plan 403 `integrations.microsoft365.plan_required`; on an active integration 400 `integration_active`. (4) The stored credentials decide the path, not a setting: **Remove authentication** returns to admin consent; while credentials are stored, the panel only shows the form. (5) The secret is never returned, `client_id` is. (6) On an expired secret the integration deactivates itself and notifies the admins (`authentication_failed`). (7) `MailboxSettings.Read` is only used by the diagnosis (`automaticRepliesSetting`); a 403 there is tolerated. (8) No certificates. Microsoft actually recommends certificates over secrets for production; refer such questions to support.
>
> **Relationships:** `/en/m365-workspace` (default path, rules, options), `/en/m365-resource-calendar-scope` (limiting via Exchange RBAC for Applications). Microsoft: [https://learn.microsoft.com/entra/identity-platform/how-to-add-credentials](https://learn.microsoft.com/entra/identity-platform/how-to-add-credentials)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.