Skip to main content
This guide shows you how to register your own app with Microsoft to obtain your OAuth credentials (client id & secret). These are required to let your users grant your app access to their OneDrive for Business account.

​
Access requirements

Pre-RequisitesStatusComment
Paid dev account✅ Not requiredFree, self-signup for a Microsoft account and Azure account.
Paid test account✅ Not requiredFree Microsoft account can be used for testing.
Partnership✅ Not required
App review⚠️ ConditionalRequired only if you want to publish your app to the Microsoft commercial marketplace or if your app needs admin consent for certain permissions.
Security audit✅ Not required

​
Setup guide

1

Create a Microsoft account and Azure account

If you don’t already have them, sign up for a Microsoft account and an Azure account.
2

Register an application in Microsoft Entra ID

  1. Sign in to the Microsoft Entra admin center as at least an Application Developer.
  2. If you have access to multiple tenants, use the Settings icon in the top menu to switch to the tenant in which you want to register the application.
  3. From the search bar at the top of the Azure portal, search for App registrations and select it. Then choose New registration. Or from your left navigation tab, navigate to Applications > App registrations then choose New registration.
  4. Enter a meaningful name for your application, for example “Nango Integration”.
  5. Under Supported account types, select the appropriate option based on your needs:
    • Accounts in any organizational directory - For multitenant apps that you want users in any Microsoft Entra tenant to be able to use.
    • Accounts in any organizational directory and personal Microsoft accounts - For multitenant apps that support both organizational and personal Microsoft accounts.
  6. Leave the Redirect URI section blank for now; we’ll configure it in a later step.
  7. Click Register to complete the app registration.
3

Note your application (client) ID

After registration, you’ll be taken to the application’s Overview page. Record the Application (client) ID, which uniquely identifies your application and is used in your application’s code as part of validating security tokens.
4

Add a redirect URI

  1. In the left sidebar, select Authentication.
  2. Under Platform configurations, select Add a platform.
  3. Select Web as the platform type.
  4. Enter https://api.nango.dev/oauth/callback as the Redirect URI.
  5. Under Implicit grant and hybrid flows, check the boxes for Access tokens and ID tokens if your application needs them.
  6. Under Advanced settings, set Allow public client flows to No for web applications.
  7. Click Configure to save your changes.
5

Add API permissions

  1. In the left sidebar, select API permissions.
  2. Click Add a permission.
  3. Select Microsoft Graph to integrate with OneNote.
  4. Choose the type of permissions:
    • Delegated permissions - Your app accesses the API as the signed-in user.
    • Application permissions - Your app accesses the API directly without a signed-in user.
  5. Select the specific permissions your app requires, Please refer to the table below for some of the commonly used scopes.
  6. Click Add permissions.
  7. If your application requires admin consent, click Grant admin consent for [tenant] to pre-authorize the permissions.
6

Create a client secret

  1. In the left sidebar, select Certificates & secrets.
  2. Under Client secrets, click New client secret.
  3. Enter a description for the secret and select an expiration period (6 months, 12 months, 24 months, or custom).
  4. Click Add.
  5. Important: Copy the secret value immediately and store it securely. You won’t be able to see it again after you leave this page.
7

Configure token settings (optional)

  1. In the left sidebar, select Token configuration.
  2. Here you can configure optional claims to be included in the ID and access tokens issued to your application.
  3. Click Add optional claim if you need to include additional information in your tokens.
8

Configure app visibility (optional)

If you want users to see your app on their My Apps page:
  1. From the search bar at the top of the Azure portal, search for Enterprise applications, select it, and then choose your app.
  2. On the Properties page, set Visible to users? to Yes.
9

Next

Follow the Quickstart.

​
Common Scopes

ScopeDescription
Files.ReadRead the signed-in user’s OneDrive files
Files.Read.AllRead all OneDrive files the user can access
Files.ReadWriteRead and write the signed-in user’s OneDrive files
Files.ReadWrite.AllRead and write all OneDrive files the user can access
Files.Read.SelectedRead selected OneDrive files the user provides access to
Files.ReadWrite.AppFolderRead and write files in the application’s special OneDrive folder
offline_accessAccess to refresh tokens for offline access
User.Read.AllRead user profiles in the organization (useful for file ownership mapping)

​
SharePoint and Graph tokens

Each connection now issues two tokens:
  1. Main Token (Graph Token): Used for standard Microsoft Graph API operations, such as making proxy calls to the Graph API at https://graph.microsoft.com.
  2. SharePoint Token (sharepointAccessToken): Available under connection_config and required when interacting with SharePoint-specific components, such as the latest File Picker (v8.0).
To obtain the sharepointAccessToken, your integration must include and request the Sites.Read.All scope during authorization. Without this scope, the SharePoint token will not be issued — only the Graph token will be available for your connection.
The sharepointAccessToken is only available for new connections. If it’s missing from your connection_config, please reauthorize your connection to obtain and include the token.

​
API tips

You can find permissions required for each API call in their corresponding API methods section, i.e, to retrieve a list available drives from OneDrive, you can have a look at List available drives permissions. For more details on Microsoft Graph API, see Microsoft Graph API documentation.