Client credentials

Introduction

This walkthrough details the process of registering a Microsoft Entra ID (formerly Azure AD) application, granting it high-level API permissions, and securely connecting it to the Mindflow platform.

On Mindflow, the related credential we will create will be of type OAuth 2.0 Client Credentials

Registering the Application in Azure

1. To begin, you must register a new application within your Microsoft Entra tenant to establish an identity for the integration.

2. Navigate to App Registrations: In the Microsoft Azure portal, go to the Microsoft Entra ID directory and select App registrations from the sidebar.

3. Create New Registration: Click on + New registration.

   

4. Configure Application Settings:

   1. Name: Enter a display name, such as “TEST”.
   2. Supported Account Types: Select Accounts in this organizational directory only (Single tenant).

5. Complete Registration: Click Register. Once created, note the Application (client) ID and Directory (tenant) ID from the Essentials overview for later use.

   

Configuring API Permissions

1. By default, new apps have limited access. You must explicitly grant the permissions required for the app to interact with Microsoft Graph data.

2. Access Permissions Menu: From the app’s sidebar, select API permissions.

   

3. Add Permissions: Click + Add a permission and select Microsoft Graph from the list of commonly used APIs.

   

   

4. Choose Permission Type: Select Application permissions. This is used for services that run without a signed-in user.

   

5. Select Specific Scopes:

   1. Now, lets search for and select user-related permissions. You can either scroll down or search

   

   1. Look for and select the following permissions: User.ReadWrite.All, User.DeleteRestore.All, and User.RevokeSessions.All.

   

   1. Click Add permissions at the bottom of the pane.

   

6. Grant Admin Consent: The status will initially show “Not granted”.

   

7. Click Grant admin consent and confirm with Yes to authorize these high-level permissions for the entire tenant.

   

Generating Authentication Credentials

To allow Mindflow to authenticate as this application, you must generate a client secret.

1. Create Secret: Navigate to Certificates & secrets and click + New client secret.

2. Set Expiration: Provide a description (e.g., “TEST”) and choose an expiration period (recommended: 180 days).

   

3. Secure the Value: Immediately copy the Secret Value.

   

Note

Note: This value is hidden after you leave the page and is required for the credential configuration in Mindflow. Store it safely!

Integrating with Mindflow

1. Finally, use the Azure details to create a functional credential within Mindflow.

   1. Secret Value you just generated.
   2. Application (Client) ID:

   

   1. OAuth Token URL

   

2. In Mindflow, open the Environments panel and, within the Global Environment or a specific one, click the + icon to create a credentials.

3. Select Service. Either:

   1. Graph (Portfolio): If you want to be able to use this credential for all API comprised within Graph (Users, Mail, Files, Sites, Devices, etc.)
   2. Microsoft Graph - Users: If you want to only allow this credential to be used with MsGraph - Users endpoints.

   

4. Configure Connection: Create a new credential and fill in the following:

   1. Credential Type: OAuth 2.0 Client Credentials.

   

   1. Client ID: Paste the Application ID from Phase 1.
   2. Client Secret: Paste the Secret Value from Phase 3.
   3. Access Token URL: Use the format https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token, replacing {tenant-id} with your actual Directory ID.

   

   1. Then, click Advanced to enable Scopes

   

   1. Enter https://graph.microsoft.com/.default.

   

5. Test the Action: Once the credential is saved, you can run a “List users” action. Don’t forget to assign the newly created credential to the step within Settings tab!

   

6. A successful integration will return a 200 OK status and the user data in the output logs.