---
title: "Connecting to Microsoft Graph (MS Graph)"
url: "https://help.formsfly.com/en/article/connecting-to-microsoft-graph-ms-graph"
language: "en"
last_updated: "2026-08-12T14:18:35.165Z"
---
# Connecting to Microsoft Graph (MS Graph)
Microsoft Graph is the unified gateway to all Microsoft 365 services. By authenticating a single MS Graph Connection, you eliminate the need for individual connections to SharePoint, OneDrive, and Excel, while gaining full support for Multi-Factor Authentication (2FA).
* * *
## In this article:
- [Prerequisites](https://help.formsfly.com/en/article/connecting-to-microsoft-graph-ms-graph#prerequisites)
- [Adding the connection](https://help.formsfly.com/en/article/connecting-to-microsoft-graph-ms-graph#adding-the-connection)
- [App Registration (Microsoft Entra Portal)](https://help.formsfly.com/en/article/connecting-to-microsoft-graph-ms-graph#app-registration-(microsoft-entra-portal))
- [Create the Registration](https://help.formsfly.com/en/article/connecting-to-microsoft-graph-ms-graph#create-the-registration)
- [Generate Credentials](https://help.formsfly.com/en/article/connecting-to-microsoft-graph-ms-graph#generate-credentials)
- [Configuring API Permissions](https://help.formsfly.com/en/article/connecting-to-microsoft-graph-ms-graph#configuring-api-permissions)
- [Required Scopes Table](https://help.formsfly.com/en/article/connecting-to-microsoft-graph-ms-graph#required-scopes-table)
- [Authorising the Connection](https://help.formsfly.com/en/article/connecting-to-microsoft-graph-ms-graph#authorising-the-connection)
- [Using the Connection in Connectors](https://help.formsfly.com/en/article/connecting-to-microsoft-graph-ms-graph#using-the-connection-in-connectors)
- [SharePoint / Excel Property Reference](https://help.formsfly.com/en/article/connecting-to-microsoft-graph-ms-graph#sharepoint-/-excel-property-reference)
- [Restricting Access with Sites.Selected](https://help.formsfly.com/en/article/connecting-to-microsoft-graph-ms-graph#restricting-access-with-sites.selected)
- [Azure Portal Configuration](https://help.formsfly.com/en/article/connecting-to-microsoft-graph-ms-graph#azure-portal-configuration)
- [Granting Permission to Specific Sites](https://help.formsfly.com/en/article/connecting-to-microsoft-graph-ms-graph#granting-permission-to-specific-sites)
- [Impact on Platform Configuration](https://help.formsfly.com/en/article/connecting-to-microsoft-graph-ms-graph#impact-on-platform-configuration)
- [Summary of Scope Differences](https://help.formsfly.com/en/article/connecting-to-microsoft-graph-ms-graph#summary-of-scope-differences)
- [Finding the User Object ID for App-Only Connections](https://help.formsfly.com/en/article/connecting-to-microsoft-graph-ms-graph#finding-the-user-object-id-for-app-only-connections)
- [Locate the User Object ID in Microsoft Entra](https://help.formsfly.com/en/article/connecting-to-microsoft-graph-ms-graph#locate-the-user-object-id-in-microsoft-entra)
- [Apply the ID to your Connector](https://help.formsfly.com/en/article/connecting-to-microsoft-graph-ms-graph#apply-the-id-to-your-connector)
- [Comparison: Why is this needed?](https://help.formsfly.com/en/article/connecting-to-microsoft-graph-ms-graph#comparison:-why-is-this-needed?)
* * *
|  | ### **Prerequisites**
You must have access to your **Microsoft Entra portal** (formerly Azure Portal) and administrative rights to grant API permissions. |
| --- | --- |
| **Feature Details** | |
| --- | --- |
| **Availability** | Required for all modern MS Connectors |
| **Supports** | SharePoint (Lists/Docs), OneDrive, OneDrive Business, Excel Online |
| **Security** | Supports 2FA and App-Only Roles |
* * *
## Adding the Connection
- Navigate to *Connections > Connections > Add Connection* (top right corner).
- Select **Microsoft Graph** from the options.
- Select the newly added connection to view its properties (if not expanded).
- Copy the **Callback URL**; you’ll need it when registering the Entra ID app.
Before moving on to App Registration (below). Note the connection’s properties needed when returning to authenticate:
- **Authenticate With** dropdown options:
- **App-Only:** Accesses data without a signed-in user. (**Application** Permission set in Entra)
- **User Account:** Acts on behalf of a signed-in user. (**Delegated** Permission set in Entra)
- **Client ID**, **Client Secret**, and **Tenant ID** fields. You’ll generate these when registering your Entra ID app.
* * *
## App Registration (Microsoft Entra Portal)
Before configuring the platform, you must register the service as an application in your Microsoft environment.
### Create the Registration
1. Log in to the [Entra Portal](https://entra.microsoft.com/#home).
2. In **Microsoft Entra ID Admin Center**, navigate to **App registrations** > **New registration**.
3. **Name:** Enter a descriptive name (e.g., “FormsFly Connector”).
4. **Supported Account Types:** Select **Accounts in any organizational directory (Any Microsoft Entra ID –** **Multitenant)** for most use cases.
5. **Redirect URI:** Select **Web** and paste the Callback URL.
### Generate Credentials
1. **Client ID:** Once registered, copy the **Application (client) ID** from the Overview page.
2. **Client Secret:** Go to **Certificates & secrets** > **New client secret**.
- *Important:* Copy the **Value** immediately; it is hidden once you leave the page.
3. **Tenant ID:** Copy the **Directory (tenant) ID** from the Overview page (required for “Organization Only” apps).
## Configuring API Permissions
Navigate to **API Permissions** > **Add a permission** > **Microsoft Graph**. You must choose between **User Account** (Delegated) or **App-Only** (Application) permissions based on your needs.
[Overview of Microsoft Graph permissions – Microsoft Graph | Microsoft Learn](https://learn.microsoft.com/en-us/graph/permissions-overview?tabs=http)
### Required Scopes Table
| **Permission Name** | **Type** | **Description** |
| --- | --- | --- |
| offline\_access | Both | Maintains access without repeated logins. |
| Sites.ReadWrite.All | Both | Full access to SharePoint lists/items. |
| Files.ReadWrite | Both | Access to user files (OneDrive/Excel). |
| User.Read | Delegated | Basic profile access for the user. |
|  | **Admin Consent**
If the status shows “Admin consent required,” a Global Admin must click the **“Grant admin consent for \[Org\]”** button. |
| --- | --- |
## Authorising the Connection
Now, link your Entra app details to the platform.
1. Navigate to **Data Hub** > **Connections**.
2. Select **Microsoft Graph**.
3. **Authenticate With:**
- **User Account:** Acts on behalf of a signed-in user.
- **App-Only:** Accesses data without a signed-in user.
*(Requires a User Object ID on specific connectors).*
4. Enter your **Client ID**, **Client Secret**, and **Tenant ID**.
5. Hit **Save**, then click the **Authorise** button that appears (depending on authentication mode).
* * *
## Using the Connection in Connectors
Once authorized, you will select this **MS Graph Connection** in the “Using Connection” dropdown for your various connectors.
### SharePoint / Excel Property Reference
| **Property** | **Requirement** | **Note** |
| --- | --- | --- |
| **Sub-Site Name** | Required | Enter only the Site Name or Subsite Name. |
| **List Name** | Required | Search for your list or enter it manually via “Specify List.” |
| **Refresh Frequency** | Required | (Data Sources only) The interval for pulling data. |
| **Filter with Graph** | Required | Define OData filter statements for efficiency.
[Customize Microsoft Graph Responses with Query Parameters](https://learn.microsoft.com/en-us/graph/query-parameters?tabs=http#filter-parameter) |
| **Columns from View** | Required | Specify the internal column names in a comma-separated list.
[How to find the internal name of list or library columns](https://sharepointstuff.com/2022/02/09/find-internal-column-name/) |
* * *
## Restricting Access with Sites.Selected
Restricting access to specific SharePoint sites rather than granting access to all site collections is a common requirement for enterprise security. Using the *Sites.Selected* scope ensures that your App Registration only interacts with the data it strictly needs.
When you use the *Sites.Selected* permission, your app has **zero** access by default. You must manually “invite” the app to specific sites.
### Azure Portal Configuration
1. Navigate to **App Registration > API Permissions**.
2. Add **Microsoft Graph** > **Application Permissions**.
3. Search for and select *Sites.Selected.*
4. **Important:** You must also add *Files.SelectedOperations.Selected* if you intend to upload or download documents.
5. Click **Grant Admin Consent**.
### Granting Permission to Specific Sites
Since there is no toggle in the Azure UI to pick sites, you must use the Microsoft Graph API to assign roles.
[Create permission – Microsoft Graph v1.0 | Microsoft Learn](https://learn.microsoft.com/en-us/graph/api/site-post-permissions?view=graph-rest-1.0&tabs=http)
**Role Options:**
- `read`: Can view and download.
- `write`: Can create, edit, and delete.
### Impact on Platform Configuration
Using restricted scopes changes how you configure connectors on the platform:
- **Search is Disabled:** The “Search” button for Site Names and Document Libraries will not work because the app cannot “see” the list of all sites.
- **Manual Entry Required:** You must provide the **Full SharePoint Site URL** (e.g., `https://tenant.sharepoint.com/sites/mysitename`) instead of just the sub-site name.
- **List Names:** You must use the **“Specify List”** option to manually type the list name, as the dropdown will appear empty.
* * *
## Summary of Scope Differences
| **Feature** | **Sites.ReadWrite.All** | **Sites.Selected** |
| --- | --- | --- |
| **Security** | Broad (Access to all sites) | Tight (Access to specific sites) |
| **UX in Platform** | Search/Dropdowns work | Manual URL entry required |
* * *
## Finding the User Object ID for App-Only Connections
When using **App-Only Authentication**, the platform needs to know whose “drive” or “context” to act within, as there is no interactive user signed in. This is why a **User Object ID** is required for connectors like Excel Online or OneDrive.
### Locate the User Object ID in Microsoft Entra
1. Log in to the [Microsoft Entra admin center](https://entra.microsoft.com/) (formerly Azure AD).
2. In the left-hand sidebar, navigate to **Identity > Users > All users**.
3. Search for the specific user whose account will “own” or host the files.
4. Click on the user’s **Display Name** to open their profile.
5. Locate the **Object ID** field (it will be a GUID, like `1a2b3c4d-5e6f-7g8h-9i0j-k1l2m3n4o5p6`).
6. Copy this ID.
### Apply the ID to your Connector
Once you have the ID, you must apply it to the specific connector you are configuring.
1. Navigate to your **Form Connector** settings (Excel Online or OneDrive).
2. Ensure the **Using Connection** dropdown is set to your **MS Graph (App-Only)** connection.
3. Find the **User ID** field.
4. Paste the **Object ID** you copied from the Entra portal.
5. **Save** your changes.
### Comparison: Why is this needed?
| **Authentication Type** | **User Context** | **User ID Required?** |
| --- | --- | --- |
| **User Account** | Inherited from the person who clicked “Authorise.” | **No** |
| **App-Only** | None (the App acts as a service). | **Yes** (To define target storage) |