Using Microsoft 365

Warning

Prerequisites for Exchange Online Integration:

Before connecting Microsoft 365, configure a valid public domain name and a valid SSL certificate issued by a trusted certificate authority on SOPS.

Go to https://<SOPS-LAN-IP>/settings/security to configure the domain and enable HTTPS. The public endpoint must be reachable by Microsoft 365.

Summary

To integrate Microsoft 365 with SyncSign On-Premise Server (SOPS):

1. Open the SOPS /o365 page and register a multitenant web application in Microsoft Entra ID.

2. Configure the Authorized Redirect URI and delegated Microsoft Graph permissions shown by SOPS.

3. Create a client secret.

4. Enter the application credentials and select the Microsoft 365 Plan in the SOPS Portal.

5. Authorize an account and bind calendars to Displays in the SOPS Portal.

For current Microsoft Entra interface instructions, refer to Microsoft’s official documentation:

• Register an application in Microsoft Entra ID

• Add a redirect URI to an application

• Configure delegated API permissions

• Add and manage application credentials

Register and Configure the Application

1. Sign in to the Microsoft Entra admin center with an account that can register applications.

2. Go to Entra ID > App registrations and select New registration.

3. Enter a meaningful application name.

App Tenant Configuration

Under Supported account types, select:

Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant)

Do not select a single-tenant account type for the SOPS Microsoft 365 application. Select Register, then record the Application (client) ID shown on the application Overview page.

App Permissions

SOPS supports Delegated OAuth only. In API permissions, add these Microsoft Graph Delegated permissions:

• User.Read

• Calendars.Read

• offline_access

For shared calendars and room resources, also add:

• Calendars.Read.Shared

If users must create or update meetings through SyncSign, also add these delegated permissions:

• Calendars.ReadWrite

• Calendars.ReadWrite.Shared

An administrator may need to grant consent according to the policies of your Microsoft 365 tenant. For permission descriptions, see the Microsoft Graph permissions reference.

Update the App Redirect URL

1. Open https://<Your-SOPS-Domain>/o365 and copy the Authorized Redirect URI shown on that page.

2. In the Microsoft Entra app registration, go to Authentication, add or edit the Web platform, and paste that URI exactly into Redirect URIs.

3. Select Save.

The displayed URI is the source of truth and must not be constructed manually. In a standard configuration it is:

https://<Your-SOPS-Domain>/o365/oauth/callback

Its origin comes from Webhook Endpoint in SOPS settings. SOPS falls back to the address used to access SOPS only when Webhook Endpoint is not configured. Always use the complete value displayed on /o365; any difference in scheme, host, port, path, or trailing slash can cause the AADSTS50011 reply URL mismatch error.

Create a Client Secret

1. In the app registration, go to Certificates & secrets > Client secrets and create a client secret.

2. Copy the secret Value immediately. Do not copy the Secret ID, and do not expose the value in tickets or screenshots.

3. Record the expiration date and replace the secret before it expires to avoid an integration outage.

Configure Microsoft 365 in the SOPS Portal

1. Open the SOPS Portal at https://<Your-SOPS-Domain>.

2. Go to Settings > Integration > Office 365 and select Edit.

3. Enter the Client ID and Client Secret from the Microsoft Entra app registration.

4. Select the Plan that matches the tenant:

   • Business for standard commercial Microsoft 365 tenants.

   • GCC High for Microsoft 365 GCC High tenants. This plan uses the US Government .us identity and Microsoft Graph endpoints.

   Selecting the wrong Plan prevents authorization or calendar access. For endpoint details, see Microsoft Graph national cloud deployments.

5. Select Save.

Authorize and Bind Calendars in the SOPS Portal

1. In Settings > Integration > Office 365, select Connect or Authorize and sign in with the Microsoft 365 account that has access to the required calendars or room resources.

2. Complete the Microsoft consent flow. Confirm that SOPS shows the integration as connected.

3. Open Nodes in the SOPS Portal and select the Display to configure.

4. Select Office 365 as its calendar data source, then select the authorized account and the required calendar or room resource.

5. Save the Display configuration and use Refresh on the Nodes page to fetch the latest calendar data and update the Display.