Overview

Microsoft Graph is the gateway to data and intelligence in Microsoft 365. The Microsoft Graph Connector enables you to connect your Mendix app to your Microsoft 365 environment through the Microsoft Graph API and enhance the experience of your users. Use the Graph Explorer to learn what you can do and extend the module with your own ideas.

Documentation

Demo login credentials

username: demo_administrator

password: OLJxO3tnlT

Description

Microsoft Graph is the gateway to data and intelligence in Microsoft 365. The Microsoft Graph Connector enables you to connect your Mendix app to your Microsoft 365 environment through the Microsoft Graph API and enhance the experience of your users. Use the Graph Explorer to learn what you can do and extend the module with your own ideas.

Microsoft Graph exposes REST APIs and client libraries to access data on the following Microsoft cloud services:

• Microsoft 365 core services: Bookings, Calendar, Delve, Excel, Microsoft 365 compliance eDiscovery, Microsoft Search, OneDrive, OneNote, Outlook/Exchange, People (Outlook contacts), Planner, SharePoint, Teams, To Do, Workplace Analytics.
• Enterprise Mobility and Security services: Advanced Threat Analytics, Advanced Threat Protection, Azure Active Directory, Identity Manager, and Intune.
• Windows 10 services: activities, devices, notifications, Universal Print.
• Dynamics 365 Business Central.

Typical usage scenario

• Allow users to use their Outlook mail to send and receive emails
• Retrieve and schedule calendar events
• Retrieve all users in your tenant and provision users with this information
• Enable SSO with Azure (requires customisation)
• Plan online meetings
• Search through your Office 365 environment and use the results in your workflow

Features and limitations

• Authorise users with an Azure App Registration so that they can interact with their Office 365 environment
• Retrieve and Update Users
• Retrieve and Update Groups
• Create and retrieve Subscriptions to Change Notifications
• Limitation: Authorization responses with a fragment payload cannot be processed by Mendix
• Limitation: Subscribing to Change Notifications is implemented, but processing Change Notifications requires customization. Content of a Change Notification can widely vary so there is no standard way to implement this.

Dependencies

• Studio Pro 9.24.30 or higher
• Encryption module
• NanoflowCommons module
• CommunityCommons module
• Data Widgets module
• Combo Box
• Access to an App Registration
• relevant API permissions in the App Registration
• a Client Secret
• the Directory (tenant) ID
• the Application (client) ID

Installation

• Install the module and all of the dependencies
• Add the snippet “Authentication_Overview” to a page that can be accessed by the Administrator
• Use the Application ID, Directory ID and Application Secret from your Azure App Registration to get authorization for your user.
• Add Snip_Login to a page that can be accessed by all users to allow users to request authorization with the Authentication you configured as an Administrator.

Configuration

1. Create an App Registration or get access to an existing App Registration in your Azure tenant. Use the Credentials to configure your Authentication and get authorization as a user. Once authorised, you can use the authorization to interact with the Office 365 resources. make sure that the App Registration has the correct API permissions.
2. To make sure the authorization flow can be completed, the Redirect URIs need to be configured in the Authentication section of your app registration. You can find (and change) the URI in the PRS_Azure REST service. For local deployment it should most likely be http://localhost:8080/microsoftgraph/oauth/v2/callback_azure.
3. Create a new Authentication object. This will be used for all authorization requests from the admin and other users that are allowed to request authorization. Fill in the Application (client) ID, Directory (tentant) ID and Client Secret from your Azure App Registration. Once these are filled in, the Well-Known Configuration will be retrieved.
4. Choose the relevant scopes for you authentication. If you want to add more scopes, you can do so in the Metadata group box in the Supported Scopes section.
5. Select your preferred Response Type, Response Mode and Prompt for authorization. Response Type "Code", Response Mode "Query" are recommended for most used cases.
6. Use the "Get Authorization as a User" button to get authorized with your own account. Use the "Get Authorization as a Service" button to get admin consent that you want to use for actions that require elevated access that you do not want to grant to individual users.