Microsoft 365 Integration
Connect OneDrive and SharePoint so users can attach documents from Microsoft 365 to requirements and other entities. Configure once per tenant in Secure Hive and in Microsoft Entra ID (Azure).
- Connect Microsoft 365: OAuth flow; each user connects once per tenant. Tokens are stored per user per tenant.
- Add from OneDrive / SharePoint: Users can list their drive items, then Link (store URL) or Copy to Secure Hive (download and store in your tenant bucket).
- Per-tenant configuration: Each Secure Hive tenant uses its own Azure AD app (Client ID, Client Secret). Credentials are stored in Secure Hive and are not read from environment variables.
- App registration → Redirect URI (Web), API permissions (Microsoft Graph delegated), Client ID, Client secret. This is where you configure what the app is allowed to do.
- Enterprise application (created from the app registration) → User/group assignment, “User assignment required?”, visibility. Admin consent is granted from the app registration or from the Enterprise app’s Permissions.
- Admin consent requests (under Enterprise apps → Activity) → Where you approve or deny user-submitted “Request approval” requests so users can use the app.
Steps
- In Secure Hive, go to Settings → Integrations.
- Open the Microsoft 365 card (under Documents) and click Configure.
- Click Create integration (or Add Integration).
- Enter the values from your Azure AD app registration:
- Client ID — Application (client) ID from the app registration.
- Client Secret — A client secret you create in the app registration.
- Azure Tenant ID (optional) — Leave blank for multi-tenant (
common), or set your tenant ID to restrict sign-in to your org. - Redirect URI (optional) — Must match the redirect URI you add in Azure (e.g.
https://your-api.example.com/auth/m365/callbackorhttp://localhost:9000/auth/m365/callbackfor local dev). If omitted, the platform usesM365_REDIRECT_URIorBACKEND_URL+/auth/m365/callback.
- Save. One active integration per tenant is used for the Connect URL, callback, and token refresh.
- In Azure Portal → Microsoft Entra ID → App registrations → New registration. Name it (e.g. “SecureHive O365”), choose supported account types, then Register.
- Authentication → Add a platform → Web. Set Redirect URI to your backend callback URL, e.g.
https://api.securehive.ai/auth/m365/callbackorhttp://localhost:9000/auth/m365/callback. This must match the value in Secure Hive (integration Redirect URI or platform default). - API permissions → Add permission → Microsoft Graph → Delegated. Add all of the following:
openid— Sign users inoffline_access— Required for refresh tokens (see below)Files.Read,Files.ReadWrite,Files.Read.All— User files (OneDrive and Teams/SharePoint channel folders)Sites.Read.All— SharePoint sitesTeam.ReadBasic.All— List teams the user is in (for Teams channel files). In Azure, search for Team (singular) to find it.Channel.ReadBasic.All— List all channels in a team (including private). Required to browse private channel files (e.g. iGRC). In Azure, search for Channel.
User.Read.) - Certificates & secrets → New client secret. Copy the secret value and paste it into Secure Hive’s integration form (Client Secret). The client secret is encrypted at rest in Secure Hive.
- Copy the Application (client) ID and paste it into Secure Hive as Client ID.
Why offline_access is required
Microsoft only returns a refresh token when the app requests the offline_access scope. Secure Hive uses the refresh token to obtain new access tokens when the current one expires (typically after about one hour), so users do not have to sign in to Microsoft 365 again every time. Without offline_access, the token response will not include a refresh token and the Connect flow will fail with “Missing access_token or refresh_token in token response.”
In the Azure portal this permission may appear as “Access and manage user data any time” under Microsoft Graph delegated permissions. After adding it, grant admin consent so it is pre-approved for your tenant.
Go to Microsoft Entra ID → Enterprise applications → find your app (e.g. “SecureHive O365”).
- Users and groups: Assign the users (or groups) who are allowed to use the app. If “User assignment required?” is Yes, only assigned users can complete Connect Microsoft 365.
- Properties: Set User assignment required? to No if you want any signed-in user to use the app (once admin consent is granted). Set Visible to users? to Yes if you want the app to appear in My Apps.
- In Enterprise applications → open your app (e.g. “SecureHive O365”) → Permissions (under Security).
- Confirm the Microsoft Graph delegated permissions are listed, including
openid,offline_access,Files.Read,Files.ReadWrite, andSites.Read.All. - Click Grant admin consent for [Your organization]. Confirm when prompted.
After this, the app is pre-approved for your tenant. Users may still see “Approval required” if your tenant requires user assignment and they are not assigned, or if your consent settings require reviewing admin consent requests (see below).
- Sign in to the Microsoft Entra admin center as a Cloud Application Administrator (or designated reviewer).
- Go to Identity → Applications → Enterprise apps.
- Under Activity, select Admin consent requests.
- Open the My Pending tab to view pending requests.
- Select the application that is being requested (e.g. “SecureHive O365”) from the list.
- Review the request:
- To see requested permissions: Review permissions and consent.
- To see app details: App details tab.
- To see who requested and why: Requested by tab.
- Take action:
- Approve — Grants admin consent; all requestors are notified and can use the app (unless restricted by user assignment).
- Deny — Provide a justification; requestors are notified. They can request again later.
- Block — Provide a justification; creates a disabled service principal so users cannot request consent for this app in the future.
Connect Microsoft 365
Users connect in one place: User Settings → Integrations tab (Profile, Avatar, Password, 2FA, Integrations). There they click Connect Microsoft 365 and are redirected to Microsoft to sign in and consent (if not already consented). After success, they are redirected back to User Settings → Integrations (same tenant host, e.g. tenant.securehive.ai or tenant.localhost).
Add from OneDrive / SharePoint
In attachment areas (e.g. project requirements), Add from OneDrive is always shown. If the user is not connected, the button is disabled and a tooltip directs them to User Settings → Integrations to connect. Once connected, the button is enabled. Users can:
- Link — Store the Microsoft 365 URL as an attachment; opening it goes to the source file.
- Copy to Secure Hive — Download the file and store it in your tenant’s document storage; the attachment is then owned by Secure Hive.
“Missing access_token or refresh_token in token response”
The app must request the offline_access scope so Microsoft returns a refresh token. In the Azure app registration, go to API permissions → Add permission → Microsoft Graph → Delegated → add offline_access (or “Access and manage user data any time”). Grant admin consent, then have the user try Connect Microsoft 365 again. See Entra: App registration for the full permission list and why offline_access is required.
“Redirect URI not configured”
Set the Redirect URI in the Microsoft 365 integration in Secure Hive (Settings → Integrations → Microsoft 365 → Edit), or set M365_REDIRECT_URI or BACKEND_URL in the backend environment. The value must exactly match the Web redirect URI in the Azure app registration.
“Approval required” / “Request approval” screen
The tenant requires admin consent and/or user assignment. Grant admin consent for the app (Enterprise application → Permissions → Grant admin consent). Assign users in Users and groups, or set User assignment required? to No. If users have already submitted requests, approve them under Enterprise apps → Activity → Admin consent requests → My Pending.
“Microsoft 365 connection was cancelled or not approved”
The user left the Microsoft consent screen (e.g. clicked “Back to app” or “Cancel”) before completing the flow. They should try again and complete sign-in/consent. If the app is not yet approved for the org, an admin must grant consent or approve the admin consent request as above.
Redirect goes to root domain instead of tenant
The callback redirect is built using the tenant’s subdomain (or tenant slug). Ensure FRONTEND_URL is set correctly (e.g. https://securehive.ai or http://localhost:3000). Tenant URLs are derived as https://<subdomain>.securehive.ai or http://<subdomain>.localhost:3000.