Configure

Create your company’s Microsoft app registration and delegated scope.

Microsoft Entra setup

Each company creates and controls its own Microsoft Entra application. InboxLink stores its public tenant and application IDs when an administrator completes signup. No Microsoft client secret is needed.

Create your company’s application

  1. In your company’s Entra tenant, create an app registration named InboxLink. Choose Accounts in this organisational directory only (Single tenant).
  2. Under Authentication, add a Single-page application (SPA) platform with these redirect URIs:
    • brk-multihub://inboxlink.app for Outlook nested app authentication.
    • https://inboxlink.app/auth/microsoft for website sign-in.
  3. Under Expose an API, use api://<your-application-client-id> as the Application ID URI.
  4. Add the delegated scope access_as_user, with Admins only consent. Use a clear description such as “Sign in to your company’s InboxLink workspace”.
  5. Add your application’s own client ID under Authorized client applications, selecting that scope. Under API permissions → My APIs, add the same delegated permission and grant admin consent for your organisation.
  6. In the app manifest, set api.requestedAccessTokenVersion to 2 and groupMembershipClaims to DirectoryRole. Keep api.acceptMappedClaims unset or false. Do not configure custom token signing keys or claims-mapping policies.
  7. Copy the Directory (tenant) ID and Application (client) ID from the Overview page.

The application requests its own delegated API scope. Microsoft Graph mailbox permissions are not needed for InboxLink’s Microsoft sign-in.

For a separately hosted deployment, substitute its actual HTTPS origin in both redirects. For local testing, add brk-multihub://localhost:3000 and the website callback http://localhost:5173/auth/microsoft to a separate development registration.

Complete company signup

Enter both IDs on the signup page, alongside your company and HaloPSA settings. The initial setup user needs an active Application Administrator, Cloud Application Administrator, or Global Administrator Entra role. Activate an eligible role first if your company uses Privileged Identity Management. InboxLink checks Microsoft’s signed directory-role claim before creating the first owner.

Signup returns a workspace code, which is your Microsoft tenant ID, and a workspace link. Share these with your users. After setup, ordinary members can sign in using the saved registration; they do not need an administrator role.

An existing workspace accepts only its saved application ID. Re-running signup requires an InboxLink owner or admin and preserves that binding. Application replacement is an operator-assisted recovery procedure, not a way to take over an existing workspace. Keep the registration until the workspace has been offboarded.

Sign-in verification

The API verifies the Microsoft signature, v2 token and signing-key issuers, expiry, tenant and user IDs, delegated scope, audience and calling application. An unverified tenant ID is used only to locate the saved public configuration. It never proves identity or permits an application override.

The website’s /auth/microsoft page uses MSAL’s redirect bridge. Preserve its no-cache headers and opener communication when adding a proxy. See Microsoft’s redirect bridge guidance.

References: Microsoft nested app authentication, directory-role token claims, Entra administrator roles.