Microsoft 365 tenants

Create the application

In Microsoft Entra admin center, go to Identity → Applications → App registrations → New registration.

• Name: M365 Domain Manager
• Supported account types: Accounts in any organizational directory (Multitenant)
• Leave the redirect URI empty here; add the Web callback in step 3.

Add Microsoft Graph permissions

Open the new app, then API permissions → Add a permission → Microsoft Graph → Application permissions.

• Domain.ReadWrite.All — required to add, verify, and manage domains.
• Organization.Read.All — optional; displays the organization name.
• Click Grant admin consent after adding the permissions.

Add the Web redirect URI

Open Manage → Authentication (Preview) → Redirect URI configuration. Click Add Redirect URI, choose Web, paste the exact URI below, and save.

• In Microsoft’s old experience, the equivalent path is Add a platform → Web.
• Do not add a trailing slash or enable the implicit-grant checkboxes.
• The scheme, hostname, and path must match exactly. Production callbacks require HTTPS.

Create the application credential

Go to Certificates & secrets. Use a certificate for long-term production operation, or create a client secret for simpler setup.

• For a secret, copy the Value immediately. This is the actual client secret and is shown only once.
• Do not copy Secret ID. It is only Microsoft’s identifier for the secret and cannot authenticate the app.
• For a certificate, upload its public certificate to Entra and keep the private key only on this server.
• Never enter a Microsoft 365 user password into this app.

Match each Entra value to the server field

The client ID and client secret are different values. Copy them from these exact locations:

Put the two correct values in /opt/m365-domain-manager/.env:

MICROSOFT_CLIENT_ID=your-application-client-id
MICROSOFT_CLIENT_SECRET=the-secret-value
MICROSOFT_REDIRECT_URI=https://trustedharbor.space/office365/api/microsoft/callback

For certificate authentication, use MICROSOFT_CERTIFICATE_PATH and MICROSOFT_CERTIFICATE_THUMBPRINT instead of the secret. Restart the web and worker services after changing the file.

Connect each Office tenant

Return here and click Connect a tenant. Sign in to the tenant with a Global Administrator or Privileged Role Administrator account and accept the consent screen.

• The tenant ID is captured automatically; do not type it into the server.
• Repeat this step for every Microsoft 365 organization you manage.
• The app stores tenant details and application consent—not the administrator password.