Update Microsoft O365 integration to MS Id Platform v2

[Gareth Cantrell]

We have the premium iBridge package which includes the Microsoft Office 365 integration which we'd really like to use in our processes.

However, the current integration appears to use Azure Active Directory v1.0 endpoints, which means the integration requests EVERY permission available and not only the permission required for the available operations (ie. calendar, contact and mail).

This is preventing us from using the integration as our SOC team is not okay with granting permissions which are not required.

We therefore are requesting that the integration is updated to use the Microsoft Identity Platform (v2) as in the below note:

https://learn.microsoft.com/en-us/azure/active-directory/azuread-dev/azure-ad-endpoint-comparison#incremental-and-dynamic-consent

[Joshua Howitt]

We are currently in the process of updating the Microsoft integrations to only require the specific scopes each integration needs to run successfully. Existing examples of this can be seen within Microsoft Teams and Entra ID.

Please let me know if you have any further questions about this.

[Martyn Houghton]

@Gareth Cantrell @Joshua Howitt

The requirement for full Admin access has been a blocker for our organisation as well and we have not been able to progress with operations such as being able to send Calendar entries to Co Workers etc, so this is really good news.

Cheers

Martyn

FYI @Paul Chambers

[Joshua Howitt]

Hi @Martyn Houghton

Glad I could help.

Josh

[Gareth Cantrell]

Wondering if there's been any updates to anymore Microsoft 365 integrations since the last update to this thread?

[Steve G]

@Gareth Cantrell This work is still ongoing, but we have deprecated the old Azure User & Group operations (that required the full Microsoft admin permissions) and replaced them with operations that require much fewer permissions to operate. Details can be found on the Hornbill wiki.

As and when more operations are replaced to use the new endpoints and fewer scopes, they will be published on the Announcements forum when released.

Thanks,

Steve 

[Gareth Cantrell]

Just checking in to see if there are any updates to this; the Microsoft key type is still requesting god-mode using the old v1 API, and we'd really like to start getting some integrations and automations working without resorting to custom code via the iBridge HTTP (experimental) integration.

[Joshua Howitt]

Hi @Gareth Cantrell, Updating the scopes on these operations is next on our list of updates and will be completed as soon as possible. I will keep you updated as this progresses.

[Joshua Howitt]

Hi @Gareth Cantrell, the new O365 operations should not request 'god-mode' permissions anymore and will run using the specific scopes required. Please let me know if you run in to any issues or have any questions.

[Gareth Cantrell]

@Joshua Howitt great work, we have successfully established a connection and can create basic calendar events, now time to fill up the forum with some more enhancement requests