Microsoft Entra ID OAuth2 Account

The Microsoft Entra ID OAuth2 Account holds the client credentials and endpoints that an Outbound OAuth2 rule uses to get an access token from Microsoft Entra ID. To create the account in the Policy builder, refer to Create an account in the Policy builder.

To use the authorization_code grant type, add a redirect URI to your application's settings at Microsoft Entra ID before you click Authorize. This form has no field for it. After you sign in, Microsoft Entra ID returns you to this URI: https://<control-plane-name>.snaplogic.com/api/1/rest/admin/oauth2callback/azureactivedirectory, where <control-plane-name> is the first part of your SnapLogic URL, such as elastic or emea. For example, https://elastic.snaplogic.com/api/1/rest/admin/oauth2callback/azureactivedirectory.

Field/Field set Description
Label Required. Specify a unique label for the account.
Tenant domain name Required. Specify the domain name of your Microsoft Entra tenant. The field comes filled in with a sample value. Replace it with your own tenant domain name.

Example: example.onmicrosoft.com
Client ID Required. Specify the application (client) ID of the app that you registered in Microsoft Entra ID. The field comes filled in with a sample value. Replace it with your app's ID.
Client secret Specify the client secret of the app that you registered in Microsoft Entra ID.
Access token This field is read-only and fills in when you click Authorize. It holds the token that the rule sends to the upstream service.
Refresh token This field is read-only and fills in when you click Authorize. The account uses this token to get a new access token before the current one expires.
Access token expiration This field is read-only and fills in when you click Authorize. It holds the time when the access token expires, as a Unix timestamp in seconds.
OAuth2 authorization endpoint Required. Specify the URL of the Microsoft Entra ID endpoint that authorizes the application. Replace <tenant-id*> with your Microsoft Entra tenant ID or tenant domain name.

Default value: https://login.microsoftonline.com/<tenant-id*>/oauth2/v2.0/authorize
OAuth2 token endpoint Required. Specify the URL of the Microsoft Entra ID endpoint that issues tokens. Replace <tenant-id*> with your Microsoft Entra tenant ID or tenant domain name.

Default value: https://login.microsoftonline.com/<tenant-id*>/oauth2/v2.0/token
Grant type Select how the account gets an access token:
  • authorization_code: A user signs in to Microsoft Entra ID, and the account exchanges the resulting authorization code for an access token.
  • client_credentials: The account gets an access token with the client ID and client secret alone.

Default value: authorization_code
Token endpoint config Parameters to send to the token endpoint. Click the plus sign to add a Token endpoint parameter and its Token endpoint parameter value. Click the minus sign to remove a row.

If Grant type is client_credentials, add a row with scope set to the resource's .default scope, such as https://graph.microsoft.com/.default. The account sends only these parameters with a client_credentials token request, not the ones in Authorization endpoint config.
Authorization endpoint config Optional parameters to send to the authorization endpoint. Click the plus sign to add an Authentication parameter and its Authentication parameter value. Click the minus sign to remove a row.

Default value: One row, with scope set to https://graph.microsoft.com/.default offline_access. The offline_access scope requests the refresh token that Auto-refresh token uses.
Auto-refresh token Select to refresh the access token automatically before it expires. The account needs a refresh token to do this.

Default status: Deselected
Description Optionally, describe the account.