All guidesMicrosoft 365
Microsoft 365 setup
Connect Open Core HR to a Microsoft Entra application and grant the permissions each feature needs.
Open Core HR uses one Microsoft 365 connector and three optional modules: Microsoft 365 Account Management, Outlook Email and Outlook Calendar Sync. The Core calendar is included and needs no Microsoft configuration.
Enable the connector and the modules you need in module management. In Settings → Microsoft 365 connection, save your tenant ID, application ID and client secret. These values belong in Settings, not .env. The application supports the Microsoft public cloud. Preserve the application's encryption key when backing up or restoring the settings database.
Use a Microsoft Entra application with application permissions and administrator consent. Grant permissions for the operations you enable and restrict mailbox access in Microsoft administration where applicable:
| Feature | Permission guidance |
|---|---|
| Link an existing account | User.Read.All for Microsoft account lookup |
| Outlook Email | Mail.ReadWrite and Mail.Send |
| Calendar sync | Calendars.ReadWrite |
| Create accounts and assign licences | See Microsoft's create-user and assign-licence requirements; licence capacity lookup also needs permission to list subscribed SKUs |
| Disable or enable access | User.EnableDisableAccount.All and User.Read.All; User.RevokeSessions.All for session revocation |
| Reset or synchronize passwords | See the passwordProfile permission and role requirements in Update user |
A successful connection test confirms authentication only. Check the intended operation with a designated test employee before enabling automatic account management. Microsoft permissions, licence availability, usage country and tenant policies can prevent individual operations.
Run the queue worker and scheduler described in Services. Auto provisioning, account-status sync and password sync start off. Calendar sync starts off and also requires each user to opt in from Calendar.
The optional system-email sender belongs to the connector. It is used only when Settings → Mail is set to Microsoft 365 (Graph); SMTP settings remain independent. Changing the connector does not switch the mail transport.
After changing tenants, link users to accounts in the new tenant. Old queued account jobs and calendar connections do not reuse the new tenant. Clearing the client secret stops Microsoft operations until valid credentials are saved again.