Microsoft 365 Directory setup guide

Agents help with people, candidates and hiring.

Ways to connect

Company admins connect apps, on the Integrations page in Everdeck: open Microsoft 365 Directory, choose one of the ways below, follow its steps and fill in its fields. Everdeck checks what you enter before it saves anything, and asks you to confirm it’s you (your second factor) before you type any secret. How connecting works.

Your Microsoft Entra app registration (app-only)

Your OAuth app.

This way uses the client ID and secret of an OAuth app you create for Microsoft 365 Directory. There’s no sign-in page: Everdeck asks Microsoft 365 Directory for a token with them.

1. Open https://entra.microsoft.com and go to Entra ID > App registrations > New registration. Name it (for example "Everdeck directory") and under Supported account types choose "Single tenant only". Microsoft asks for a redirect URI only for sign-ins; this method doesn't use one, so leave it empty.
2. Under API permissions, choose Add a permission > Microsoft Graph > Application permissions and add User.Read.All. To sync only the members of a group, add GroupMember.Read.All too. Then click "Grant admin consent".
3. Under Certificates & secrets, create a client secret and copy its Value (it is shown once).
4. Copy the Application (client) ID and the client secret into the form, with the Directory (tenant) ID from the app's Overview page.

Field	What to enter
Directory (tenant) ID	Text. For example 00000000-0000-0000-0000-000000000000.

The scopes Everdeck asks for:

• https://graph.microsoft.com/.default

Disconnecting deletes the access token Everdeck saved for this connection. The OAuth app's client ID and secret stay saved under OAuth apps in Everdeck and keep working at Microsoft 365 Directory until you delete the app or rotate its secret there.

What agents can do

An agent uses an action only when its charter grants it, on the agent’s Tools tab, where you choose whether each one runs by itself (Auto), asks first or never runs. Each action has a risk tier: tier 3 actions, which customers or the public see, ask first unless you choose otherwise, and tier 4 actions (money, deleting things, access) always need a person. How tools and tiers work.

Actions marked Reads outside content return things people outside your company may have written. Agents treat what they read as information, never as instructions, and their riskier actions later in the same session need approval.

• List usersTier 0 · ReadReads outside contentmicrosoft_directory_list_users

  List the organization's users with their manager: id, display name, email, user principal name, job title, department, office location, city, country, employee id, whether the account is enabled and the manager's id and name.

• Find people by nameTier 0 · ReadReads outside contentmicrosoft_directory_find_users

  Find users whose display name, given name, surname, email or user principal name starts with the text given. Returns id, name, email, job title and department.

• Read a userTier 0 · ReadReads outside contentmicrosoft_directory_get_user

  Read one user by id or user principal name: name, email, job title, department, office, city, country, employee id, whether the account is enabled, and their manager.

• List groupsTier 0 · ReadReads outside contentmicrosoft_directory_list_groups

  List the organization's groups with id, name, description and email address.

• List a group's peopleTier 0 · ReadReads outside contentmicrosoft_directory_list_group_members

  List the users in a group, including the members of groups nested inside it: id, name, email, job title and department.

Testing, problems and disconnecting

Everdeck checks the connection when you save it. On the connection’s page in Integrations, Test checks it again at any time.

If Microsoft 365 Directory later refuses the connection, for example because a key was deleted or a sign-in expired, the connection shows Needs attention on the Integrations page and the people who manage connections are told. Agents can’t use it until a company admin fixes it with Edit.

To stop agents using Microsoft 365 Directory, open the connection and select Disconnect. Agents stop using it at once and its saved credentials are deleted. What else happens depends on how it was connected: each way above says.