Microsoft Azure (OAuth) Service Account — Setup Guide

Overview Use this guide to create and configure a Microsoft Azure (OAuth) service account in MinuteView Console. This service account uses OAuth 2.0 with delegated (user-login) permissions to enable system-level access to Microsoft services for:

• SharePoint — Access and manage files, lists, and sites via Microsoft Graph
• OneDrive — File storage and synchronization operations
• Microsoft Graph API — Access users, groups, mail, calendars, and other Microsoft 365 data
• Workflow automation — Trigger Microsoft operations from MinuteView Automations

This is the OAuth (delegated) variant — it requires a user to log in and authorize access. For server-to-server access using application-only permissions (no user login), use the Azure Service Account instead.

Unlike a third-party Microsoft account (which is linked to an individual user), a service account operates at the system level with group-based permissions. This means workflows and automations use a shared Microsoft identity rather than a specific user's personal account.

---

Network Requirements

The Azure OAuth service account setup involves an OAuth flow where part of the process happens in the user's browser and part happens on the MinuteView server itself. After the user authenticates with Microsoft and is redirected back to MinuteView, the server exchanges the authorization code for a token by calling Microsoft's API directly. This means the MinuteView server must have outbound internet access to the following domains.

Required Firewall / Proxy Whitelist

The following domains must be accessible via HTTPS (port 443) from the server where MinuteView is installed:

Domain	Purpose
login.microsoftonline.com	OAuth token exchange, token refresh, and authorization
graph.microsoft.com	Microsoft Graph API calls (SharePoint, OneDrive, user profiles, etc.)

Server Access Required

These domains must be reachable from the server, not just from the user's PC. The user's browser handles the initial login redirect, but the token exchange and all subsequent API calls are made server-side. If the server cannot reach these domains, the service account setup will fail with a connection error even though the Microsoft login page loaded successfully in the browser.

---

1) Create App Registration in Azure Portal

Register Application

1. Sign in to Azure Portal at https://portal.azure.com
2. Navigate to Microsoft Entra ID → App registrations → New registration
3. Configure:
   • Name: MinuteView OAuth Service Integration
   • Supported account types: Single tenant (recommended)
   • Redirect URI: You will set this in step 2 below — leave blank for now
4. Click Register

Collect Credentials

From the app's Overview page, note:

• Application (client) ID
• Directory (tenant) ID

Create Client Secret

1. Navigate to Certificates & secrets → Client secrets → New client secret
2. Description: MinuteView OAuth Integration
3. Expires: Choose appropriate duration (24 months recommended)
4. Copy and securely store the secret value

Configure API Permissions

1. Navigate to API permissions → Add a permission → Microsoft Graph
2. Select Delegated permissions (not Application permissions — this is the OAuth flow)
3. Add the permissions your workflows need, e.g.:
   • User.Read — Sign in and read user profile
   • Files.ReadWrite.All — Full access to user's files
   • Sites.ReadWrite.All — Read and write items in all site collections
   • offline_access — Maintain access to data (enables refresh tokens)
4. Click Grant admin consent for [Organization] if required

---

2) Create Service Account in MinuteView Console

1. Navigate to Console → Service Accounts
2. Click New to create a new service account
3. Configure the following settings:

Configuration Fields

Field	Description	Example
Name	A descriptive name for this service account	Azure-OAuth-ServiceAccount-Prod
Service Account Type	Select Microsoft Azure (OAuth) from the dropdown
Tenant ID	Your Azure AD Directory (tenant) ID	87654321-4321-4321-4321-210987654321
Client ID	The Application (client) ID from Azure app registration	12345678-1234-1234-1234-123456789012
Client Secret	The client secret value from Azure	(sensitive — stored securely)
Scope	OAuth scopes (space-separated). Include offline_access for token refresh.	openid profile offline_access https://graph.microsoft.com/.default
Callback URL	The MinuteView OAuth redirect URI	https://your-server/MinuteView/PageGeneral/ServiceCallback.aspx

4. Before saving: Copy the Callback URL and add it as a redirect URI in the Azure app registration under Authentication → Platform configurations → Web → Redirect URIs
5. Click Save and Login to save the configuration and begin the OAuth flow

OAuth Authentication Flow

6. You will be redirected to the Microsoft login page
7. Sign in with the Microsoft account whose permissions the service should operate under
8. Grant MinuteView the requested permissions
9. You will be redirected back to MinuteView — the service account will show Connected status

---

3) Token Management

MinuteView automatically manages OAuth tokens for this service account:

• Access Token: Used for API calls (expires in 60–90 minutes)
• Refresh Token: Used to obtain new access tokens (long-lived, requires offline_access scope)
• Automatic Refresh: MinuteView refreshes tokens before expiration

---

4) Azure (OAuth) vs Azure (Client Credentials)

MinuteView offers two Azure service account types:

	Azure (OAuth) — this page	Azure (Client Credentials)
Authentication	User logs in and authorizes	App authenticates with secret/cert — no user login
Permissions	Delegated (acts as the signed-in user)	Application-only (acts as the app itself)
Use when	You need to act on behalf of a specific user, or the API requires delegated permissions	You need server-to-server access without user interaction
Token refresh	Uses refresh token (requires offline_access scope)	Requests new token with client credentials

---

5) Troubleshooting

"Failed to retrieve authentication token" / Connection error

• The most common cause is that the MinuteView server does not have outbound internet access. See Network Requirements above for the domains that must be whitelisted.

Redirect URI Mismatch

• Verify the callback URL in the Azure app registration exactly matches the URL shown in MinuteView Console
• Check for trailing slashes or protocol differences (http vs https)

AADSTS700016: Application not found

• Verify Client ID is correct
• Ensure the app registration exists in the correct tenant

AADSTS7000215: Invalid client secret

• Verify the client secret has not expired
• Check for typos — generate a new secret if needed

Insufficient Privileges

• Verify the correct delegated permissions are granted (not application permissions)
• Ensure admin consent was provided where required
• Check the authenticated user has the necessary access to the target resources

Token Refresh Failures

• Ensure offline_access is included in the scope
• Re-authenticate by clicking the Login button again
• Verify the authenticated user's account is still active