Microsoft 365 setup

ServiceOps connects to Microsoft 365 through your own Microsoft Entra app registration — never a ServiceOps-wide application. You create it once, in your tenant, with access to the one mailbox ServiceOps should monitor.

1. Create an app registration

1. Open the Microsoft Entra admin center.
2. Go to App registrations → New registration and name it — e.g. ServiceOps Email Channel.
3. Under Redirect URI, choose Web and paste the callback URL shown in the ServiceOps wizard:

   https://YOUR_SERVICEOPS_DOMAIN/api/email-channels/oauth/microsoft-graph/callback

4. Register.

2. Grant API permissions

1. In the registration: API permissions → Add a permission → Microsoft Graph → Delegated permissions.
2. Add Mail.Read and offline_access (the second lets ServiceOps refresh its access without asking you to sign in again every hour).
3. Choose Grant admin consent for your tenant.

Shared mailbox?

The account that signs in during the connection must have delegated access to the shared mailbox — Graph evaluates Mail.Read against the mailbox being read, not only the signed-in user’s own.

3. Create a client secret

Certificates & secrets → New client secret. Copy the secret’s Value immediately — Microsoft shows it once.

4. Connect in ServiceOps

1. In Settings → Email channels, choose Microsoft 365.
2. Enter the Tenant ID and Application (client) ID (from the registration’s Overview page), the client secret, and the mailbox address.
3. Create the channel, then choose Connect my Microsoft account — sign in, consent, and you are returned automatically.

Result: the channel shows Connected, and ServiceOps subscribes to the mailbox’s new messages through Microsoft’s push notifications.

How it stays connected

• Graph subscriptions expire within ~7 days; ServiceOps renews daily, well inside the window.
• Microsoft rotates refresh tokens on use; ServiceOps persists each new one immediately, so the connection does not silently break.
• If Microsoft signals that reauthorization is needed, ServiceOps recreates the subscription and reconciles anything missed in between.
• If consent is revoked or the secret expires, the channel shows Authentication error — reconnect with the same button after fixing the cause.

Official Microsoft references

• Microsoft Graph webhooks
• OAuth 2.0 authorization code flow