Skip to main content

Microsoft cloud services

This article describes how to integrate with Microsoft (using its API) and use the received data in multiple ways in Wallboard.

Wallboard provides two ways to access data from the Microsoft ecosystem:

  • Delegated access, an app acting on behalf of a signed-in user.
  • App-only access, an app acting with its own identity.
    • Also called: Service Principal / Service Account

Learn more

Access data on behalf of a signed-in user​

info

Wallboard can only access data that the connected user has access to.

Access user's personal data​

  1. Add new Microsoft credential
  2. Select the scope
  3. Set the tenant type to Personal Account
  4. Click on Authenticate
  5. Follow the steps in the pop-up

Access SharePoint resources (user is part of a corporate tenant)​

  1. Add new Microsoft credential
  2. Select the scope
  3. Set the tenant type to Work or School Account
  4. Choose SharePoint in the add modal
  5. Click on Authenticate
  6. Follow the steps in the pop-up
Important

Connecting a SharePoint account requires admin consent!

Learn more

The actual setup flow can be different based on your configuration at Azure.

Learn more

Access data as a Service Principal (Service Account)​

Wallboard gives the option to use service principals (app-only access) besides the on behalf of a signed-in user (delegated) method to access data.

Service principals
An Azure Active Directory (Azure AD) service principal is the local representation of an application object in a tenant or directory. It's the identity of the application instance. Service principals define application access and resources the application accesses. A service principal is created in each tenant where the application is used and references the globally unique application object. The tenant secures the service principal sign-in and access to resources.

Register an App in Azure AD​

To have a Client ID and Client Secret first you have to create an application registration in Azure AD.

Navigate to App Registrations

Click on New Registration

register-application.png

info

The redirect URI must point to the actual Wallboard server (replace [server_domain]).

https://[server_domain]/public-api/microsoft/authCallback/serviceAccount

Setup permissions​

Add the necessary permissions (scopes) to the application:

application-permissions.png

The following permissions are required in the different use cases:

  • Read calendar data (connect it as a datasource)
    • Calendar.Read
  • Read and edit events in a calendar (required for complex meeting room solutions)
    • Calendar.ReadWrite
  • Sync a folder from a drive (user's or site's drive)
    • Sites.Read.All
    • Files.Read.All
  • Read SharePoint lists (connect it as a datasource)
    • Sites.Read.All
    • Files.Read.All
  • Read Excel workbooks (connect it as a datasource)
    • Sites.Read.All
    • Files.Read.All
  • Power BI
    • No specific scope required
info

In order to access a Power BI workspace with a service principal you need to

  • Enable Allow service principals to use Power BI APIs
    • Settings -> Admin portal -> Developer settings
  • Add the service principal to your workspace with Member role (use the Display name of the created application)
    • Select workspace -> Manage access -> Add people and group

Learn more

To allow embedding in a content:

  • Enable Embed content in apps
    • Settings -> Admin portal -> Developer settings

add-app-to-workspace.png

Add a new client secret​

At Certificates & secrets create a new client secret and copy the Value (not the Secret ID). You will need this secret in a later step, referred to as Client Secret.

add-client-secret.png

caution

Check the secret expiration, because after that Wallboard won't be able to request new tokens and the integration will be broken.

On expiration there is an option in Wallboard to update the secret on the credential.

Using certain permissions requires admin consent. There is an indicator for it in the Admin consent required column. In order to grant admin consent click on the Grant admin consent for [My Company name] button at the API permissions menu.

grant-admin-consent.png

Important

In case of service principals, grant admin consent through the Azure AD console as detailed above.

Granting admin consent during the browser sign-in flow instead can result in a token that is missing the required scopes, so we highly recommend granting admin consent to the application before configuring anything in Wallboard.

Set up connection in Wallboard​

  1. Add new Microsoft credential
  2. Select the scope
  3. Set the tenant type to Service Principal
  4. Fill Client ID and Client Secret
  5. Click on Authenticate
  6. Follow the steps in the pop-up
Last updated on