Application ID and Secret

Summary

• Runs: as background service.
• Scenario: attended, unattended, and unattended with MFA enabled.
• Application permissions.
• Recommended for unattended executions or when you want to access the Microsoft Graph API as an application (a background service / daemon) without a signed-in user.

Details

• When registering your application, you must select an application type. For application ID and secret authentication type, use a web application (which uses OAuth 2.0 client credentials flow).

• You must configure the appropriate API permissions for the Azure application in order for Microsoft 365 activities to work properly. For more information, see Working with activity scopes.

• A single organization can have multiple application (client) IDs. Each application (client) ID contains its own permissions and authentication requirements. For example, you and your colleague can both register a Microsoft 365 application in your company's Azure Active Directory with different permissions. Your app can be configured to authorize permissions to interact with files only, while your colleague's app is configured to authorize permissions to interact with files, mail, and calendar.

• For email activities, it is mandatory to specify a value for the Account parameter (i.e. which mailbox of all tenant's mailboxes do you want to use).

• Use the Sites.Selected application permission to allow the application to access specific SharePoint site collections rather than all. When you add the Sites.Selected permission, you also need to specify the sites the application can access. You can do this through Postman. Note that you can use the Sites.Selected instead of Sites.ReadWrite.All to limit which sites the app can have access. For more information, see Controlling app access on a specific SharePoint site collections.
• When using this authentication type, the application has access to all mailboxes from your tenant. The application API permission Mail.Read means "Read mail in all mailboxes" and Mail.ReadWrite means "Read and write mail in all mailboxes". You can restrict the application permissions to specific mailboxes, so that the application accesses only the specified mailboxes. For more information, see Scoping application permissions to specific Exchange Online mailboxes.