--- title: Microsoft Graph API slug: authentication-guides/microsoft-graph-api docTags: createdAt: 2026-01-19T16:09:00.724Z --- # Introduction This guide explains how to authenticate the Microsoft Graph API connector in Swimlane using one of the following authentication methods: - OAuth 2.0 Client Credentials (Application permissions) - Password Grant (Delegated permissions) - Refresh Token Grant (Delegated permissions with MFA) You will create an Azure app, assign permissions, collect the required identifiers, and configure the connector inside Swimlane. # Prerequisites Azure Access Requirements You must have Azure permissions to: ----------------------------------- - Register applications in Azure Active Directory - Assign API permissions (Application + Delegated) - Grant admin consent - View tenant, subscription, and directory information - Create client secrets ## Required Credentials During setup, you will collect: - Client ID - Client Secret - Tenant ID - Token URL - Scope - (For delegated auth) Username & Password - (For refresh token flow) Refresh Token # Authentication Methods Overview ## OAuth 2.0 Client Credentials Used for non-MFA accounts and for most server-to-server automations. You will need: - Client ID - Client Secret - Tenant ID - Token URL (must include Tenant ID) - Scope(s) ## OAuth 2.0 Refresh Token Grant Use this when: - The Office 365 account has MFA enabled - You need a long-lived token flow based on user authentication You will need: - Client ID - Client Secret - Refresh Token - Redirect URI (added during Azure App Registration) # Azure Setup Take the following steps to register the application: 1. Go to Azure Portal > Azure Active Directory > App Registrations. 2. Click **New Registration.** 3. Enter an application name. 4. Select **Accounts in this organizational directory only.** 5. Click **Register.** Take the following steps to assign the API permissions: 1. Open the **API Permissions** tab. 2. Click **Add a permission.** 3. Add the required permissions (recommended): - User.ReadWrite.All - Calendars.ReadWrite - Directory.ReadWrite.All - Directory.AccessAsUser.All - SecurityEvents.Read.All - SecurityEvents.ReadWrite.All - Mail.ReadWrite - Mail.Send - Sites.ReadWrite.All - Files.ReadWrite.All - AuditLog.Read.All - Mail.ReadBasic.All - SecurityAnalyzedMessage.ReadWrite.All - SecurityAlert.ReadWrite.All - User.ManageIdentities.All :::hint{type="info"} These permissions enable Graph API actions across email, directory, SharePoint, files, and security. ::: 4. Click **Add permissions.** 5. Click **Grant admin consent for your organization.** ### Delegated Permissions (for Password Grant & Refresh Token) Add Delegated Permissions instead of Application Permissions when using delegated auth. After adding permissions: - Click Add permissions. - Then click Grant admin consent. Take the following steps to generate a client secret 1. Go to Certificates & secrets. 2. Click **New client secret.** 3. Add description and expiration. 4. Click **Add.** 5. Copy and save the value. This saved value is Client Secret. Take the following steps to collect required Identifiers: From **App Registration > Overview**, copy: - Client ID - Tenant ID Take the following steps to collect username and password (delegated auth only) If using Password Grant: - oauth\_un → Azure username - oauth\_pwd → Azure password :::hint{type="info"} **I**f MFA is enabled, use Refresh Token Flow instead. ::: Take the following steps to generate a Refresh Token: For accounts with MFA enabled: 1. In the Registration step, add a Redirect URI (Platform: Web). 2. Complete app registration. 3. Assign Delegated Permissions. 4. Use the Python script provided by the Swimlane team to generate a Refresh Token. # Connector Configuration in Swimlane 1. Log into **Turbine.** 2. From the left-hand navigation pane, click** ORCHESTRATION **and click** Assets.** Asset homepage opens. 3. Click the **+ icon** to create a new asset. 4. Select **Microsoft Graph API **from the Asset Type list. 5. Fill in the **Asset Settings** and **Asset Input** as shown: **a) Configuration - Client Credentials** Authenticates using OAuth 2.0 client credentials. | **Field** | **Description** | **Required** | | -------------- | ------------------------------------------------------------------------------------------------------- | ------------ | | url | Microsoft Graph API endpoint | Required | | client\_ID | Client ID from Azure | Required | | client\_Secret | Client Secret from Azure | Required | | tenant\_id | Tenant ID | Required | | token\_url | [https://login.microsoftonline.com/](https://login.microsoftonline.com/)\{tenant\_id}/oauth2/v2.0/token | Required | | scope | Permission scopes | Required | | verify\_ssl | Enable/Disable SSL verification | Optional | | http\_proxy | Proxy details | Optional | Fields with \* marks are required. ![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/PE-Rw0FuAD4mJ1gsk80oR_image.png) **b) Configuration - Password Grant (Delegated Authentication)** Authenticates on behalf of a user. | **Field** | **Description** | **Required** | | ----------------- | -------------------------------------------------------------------------------- | ------------ | | url | Microsoft Graph API endpoint | Required | | login\_url | Default:[ https://login.microsoftonline.com](https://login.microsoftonline.com/) | Optional | | tenant\_id | Tenant ID | Required | | oauth\_un | Username | Required | | oauth\_pwd | Password | Required | | oauth\_cl\_id | Client ID | Required | | oauth\_cl\_secret | Client Secret | Required | | scope | Delegated scopes | Optional | | verify\_ssl | SSL verification | Optional | | http\_proxy | Proxy | Optional | Fields with \* marks are required. **c) Configuration - Refresh Token Grant (Delegated + MFA)** Authenticates using a previously generated Refresh Token. ![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/gt4Vk5LyLDOaHmC3bniCL_image.png) | **Field** | **Description** | **Required** | | -------------- | ---------------------------- | ------------ | | url | Microsoft Graph API endpoint | Required | | cl\_id | Client ID | Required | | cl\_secret | Client Secret | Required | | refresh\_token | Refresh Token | Required | | scope | Permission scopes | Required | | verify\_ssl | SSL verification | Required | | http\_proxy | Proxy | Required | Fields with \* marks are required. 6\. Click **Create.** # Troubleshooting ## 403 Forbidden ### Occurs when: - Missing Graph API permissions - Missing admin consent - Incorrect tenant or token URL - Using Application permissions where Delegated is required ### Fix: - Re-grant admin consent - Verify permissions - Ensure token URL includes the correct tenant ID You have successfully authenticated the Microsoft Graph API Connector using one of the supported OAuth flows.