KBTT

What this lesson covers

Register an application in Microsoft Entra ID, give it the right Microsoft Graph permissions, and connect it to n8n so your workflows can read mail and calendars, work with SharePoint and OneDrive files, and post into Microsoft Teams. You will build both authentication styles and a working smoke-test workflow. Budget about 40 minutes.

Two ways to authenticate — pick before you click anything

	Delegated (OAuth2, "on behalf of a user")	Application (app-only / service principal)
Who the call acts as	The signed-in user	The app itself, no user
Can access	Only what that user can access	Whatever tenant-wide permission you grant
n8n credential	Microsoft OAuth2 / Teams OAuth2 — you click Connect my account	Service Principal (App-Only)
Needs a redirect URI	Yes	No
Teams chats & online meetings	Yes	No — those operations require a signed-in user
Good for	Personal or single-operator automations	Unattended, server-side, tenant-wide automations

Most people start delegated (Labs 1–5) and move to app-only when the workflow must run with nobody logged in (Lab 6). The app registration itself is the same object — only the permission type and the credential in n8n change.

Before you start

An Entra ID tenant, and a role that can register apps: Application Developer or higher. (Some tenants block self-service registration entirely — then you need an admin to do Lab 1 for you.)
Someone with Privileged Role Administrator or Global Administrator to grant admin consent in Lab 3. Plan for this — it is where most people stall.
An n8n instance reachable over HTTPS at a stable URL. Entra will not accept an http:// redirect URI except for localhost.

Entra admin center tour

Where	What it is for
entra.microsoft.com → Entra ID → App registrations	The list of your apps. Everything below lives here.
App → Overview	Application (client) ID and Directory (tenant) ID — the two values you will copy.
App → Authentication	Redirect URIs and platform type.
App → Certificates & secrets	Client secrets and certificates.
App → API permissions	Graph scopes, and the Grant admin consent button.
Enterprise applications	The service principal side: who has consented, sign-in logs, and where you disable an app in a hurry.

Lab 1 — Register the application

In n8n, create the credential first: Credentials → New → Microsoft Teams OAuth2 API (or Microsoft OAuth2 API for Graph generally). Copy the OAuth Redirect URL it displays. On self-hosted n8n this is your instance's base URL plus the OAuth2 credential callback path; copy it from the UI rather than typing it — it must match byte for byte.
Go to entra.microsoft.com → Entra ID → App registrations → New registration.
Name: something a future admin will understand — n8n-automation-prod, not test app.
Supported account types: n8n's documentation asks for "Accounts in any organizational directory and personal Microsoft accounts". If your tenant's policy forbids multi-tenant apps, single tenant works fine when every account you will connect lives in your own tenant.
Redirect URI: platform Web, value = the URL you copied in step 1.
Register, then from Overview copy the Application (client) ID and Directory (tenant) ID.

Done when: the app exists and you have both IDs saved somewhere safe.

Lab 2 — Create a client secret

App → Certificates & secrets → Client secrets → New client secret.
Description: name it after the consumer (n8n). Expiry: shorter is safer; Entra caps custom secrets at 24 months.
Copy the Value column immediately.

Copy the Value, not the Secret ID. The value is shown once and never again; the Secret ID sitting next to it looks similar and is useless for authentication. Pasting the wrong one produces AADSTS7000215: Invalid client secret provided — the single most common failure in this whole lesson.

Put a calendar reminder on the expiry date now. An expired secret takes every workflow down silently at 3am with no warning from n8n.

Done when: you hold the client ID, tenant ID and secret value, and have a reminder set before the expiry.

Lab 3 — Add Graph permissions and grant consent

App → API permissions → Add a permission → Microsoft Graph → Delegated permissions.

Add what your workflows actually need. Starting points by node:

n8n node	Delegated Graph scopes
Microsoft Teams — channels & channel messages	`Group.ReadWrite.All`, `ChannelMessage.Send`
Microsoft Teams — chats	`Chat.ReadWrite`
Microsoft Teams — online meetings	`OnlineMeetings.ReadWrite`
Microsoft Outlook — mail	`Mail.ReadWrite`, `Mail.Send`
Microsoft Outlook — calendar	`Calendars.ReadWrite`
SharePoint	`Sites.Read.All` or `Sites.ReadWrite.All`
OneDrive	`Files.ReadWrite.All`
Entra ID node (users, groups)	`User.ReadWrite.All`, `Directory.ReadWrite.All`, `GroupMember.ReadWrite.All`
Always	`openid`, `offline_access` — `offline_access` is what gives n8n a refresh token

Click Grant admin consent for <tenant> and confirm. Every row should turn green.

Grant the narrowest set that works. n8n's default scope lists are broad because they must cover every operation of every node. Trimming them is good practice, but n8n warns that "some features may not work as expected with more restrictive scopes" — so trim deliberately, then test each operation you rely on.

Done when: API permissions shows "Granted for <tenant>" against every scope.

Lab 4 — Connect the credential in n8n

Back in the n8n credential, paste the Client ID and Client Secret.
If you registered the app single-tenant, or you are on a government cloud, set the tenant explicitly — the authorization and token URLs take a tenant segment:
```
https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize
https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
```
where {tenant} is your Directory (tenant) ID; common is the multi-tenant default. Government cloud uses login.microsoftonline.us.
Click Connect my account, sign in, and accept the consent prompt.
Save. n8n should show the credential as connected.

Done when: the credential shows a successful connection with no error banner.

Lab 5 — Smoke-test it in a workflow

New workflow → Manual Trigger.
Add a Microsoft Teams node. Resource Channel Message, operation Create. Select your credential, then pick a Team and Channel from the dropdowns.
Message: Hello from n8n. Execute the node.

Two things are being tested here, and it is worth separating them: the dropdowns populating proves your token can read Teams and groups; the message arriving proves it can write. If the dropdown is empty, the problem is read permission or consent, not the node configuration.

Now add a second node — Microsoft Outlook, operation Get Many messages, limit 1 — to confirm the same registration covers more than Teams.

Done when: the message appears in the Teams channel and Outlook returns a message.

Lab 6 — The app-only variant

For workflows that must run unattended, repeat the registration without a user in the loop.

App → API permissions → Add a permission → Microsoft Graph → Application permissions this time. For posting to channels: ChannelMessage.Send and Group.ReadWrite.All. For mail: Mail.Send.
Grant admin consent — not optional here. Application permissions never work without it.
In n8n, create a Service Principal (App-Only) credential and supply tenant ID, client ID and client secret. There is no browser sign-in step.
Re-run the Lab 5 channel message. It should still work.
Now try a chat message operation. It will fail — by design. Chat and online-meeting operations need a signed-in user and are unavailable app-only.

Application permissions are tenant-wide. Mail.Send as an application permission means the app can send mail as anyone in the tenant. Scope it down with an application access policy so it can only touch the mailboxes you intend.

Done when: an app-only credential posts to Teams, and you have seen the chat operation fail and understand why.

Troubleshooting

Error	What it means	Fix
`AADSTS50011` redirect URI mismatch	The URI in Entra is not exactly what n8n sent	Re-copy the OAuth Redirect URL from the n8n credential. Watch for a trailing slash, http vs https, or a stale hostname after moving instances.
`AADSTS7000215` invalid client secret	You pasted the Secret ID instead of the Value — or the secret expired	Create a new secret and copy the Value column.
`AADSTS65001` consent required	Nobody granted admin consent	API permissions → Grant admin consent. Needs a privileged admin.
`AADSTS700016` app not found in directory	Single-tenant app being reached via `common`, or wrong tenant	Put your tenant ID in the auth and token URLs, or make the app multi-tenant.
`AADSTS50020` user account from another tenant	Signing in with a personal or guest account a single-tenant app will not accept	Sign in with an account from the app's own tenant.
Teams/Channel dropdowns empty	Token has no read permission, or consent not granted	Add `Group.ReadWrite.All`, grant consent, then reconnect the credential.
`403 Forbidden` from Graph on one operation only	Missing the scope for that specific call	Check the operation's scope in the Lab 3 table, add it, re-consent, reconnect the credential — existing tokens do not gain new scopes.
Worked for weeks, now every Microsoft node fails	Client secret expired	New secret, paste into n8n. Set the reminder this time.
Chat or meeting operations missing/failing	Using app-only auth	Expected. Use a delegated OAuth2 credential for those.

Knowledge check

Q1. Delegated or application permission — which does an unattended nightly workflow need?
Application (app-only). Delegated permissions act as a signed-in user, and there is no user at 3am.

Q2. Why can't an app-only credential post a Teams chat message?
Chat and online-meeting operations require a signed-in user, so they are unavailable without delegated auth.

Q3. You get AADSTS7000215. What did you almost certainly do?
Copied the Secret ID instead of the secret Value. The value is only visible at creation time.

Q4. What does offline_access buy you?
A refresh token — without it n8n loses access when the access token expires an hour later.

Q5. Your Teams dropdowns are empty but the credential says connected. Where do you look?
Permissions and consent, not node config. Connecting proves the sign-in worked; it proves nothing about Graph scopes.

Q6. You added a scope in Entra and granted consent, but n8n still returns 403. What is missing?
Reconnecting the credential. The existing token was issued with the old scopes and will not gain new ones.

Q7. Which two IDs do you copy from the app's Overview page?
Application (client) ID and Directory (tenant) ID.

Q8. Why is app-only Mail.Send dangerous, and what limits it?
It lets the app send as any mailbox in the tenant. An application access policy restricts it to named mailboxes.

FAQ

Do I need one app registration per workflow?
No — but one per system is good practice. A single "n8n" registration for all n8n workflows means one secret to rotate and one place to revoke; sharing it with unrelated tools does not.

Single tenant or multi-tenant?
n8n's docs ask for the multi-tenant + personal accounts option, which is the safest default for their instructions. If every account you connect is in your own tenant, single tenant is tighter and works fine — just put your tenant ID in the auth and token URLs.

Certificate instead of a client secret?
Supported by Entra and preferable for production: certificates can be longer-lived and are not copy-pasteable. Check your n8n version supports certificate credentials for the node you need before committing.

What if my tenant blocks users from registering apps?
Then an admin must create the registration. Send them this lesson's Labs 1–3 plus the exact scope list — specific requests get approved far faster than "I need access to Graph".

Does n8n Cloud need any of this?
No. On n8n Cloud you click Connect my account and use n8n's own registration. You need your own app registration when self-hosting, or when you want the permissions and audit trail under your tenant's control.

How do I audit or kill this access later?
Entra ID → Enterprise applications → your app. Sign-in logs show every token issued; disabling the service principal there stops all of it immediately, without deleting the registration.

Can I use the same registration for Power Automate or a PowerShell script?
Technically yes, but don't. Separate registrations mean you can rotate or revoke one without breaking the others, and per-app sign-in logs stay readable.

Where do secrets live in production?
Not in the workflow. n8n credentials are encrypted at rest with your instance's encryption key — back that key up, and never commit it or a .env containing it.

Resources

Entra admin center — https://entra.microsoft.com
Register an application (Microsoft Learn) — quickstart-register-app
Add credentials (secrets and certificates) — how-to-add-credentials
Microsoft Graph permissions reference — permissions-reference
Limit app-only mailbox access — application access policies
Entra authentication error codes — AADSTS reference
n8n Microsoft credentials — docs.n8n.io → Microsoft
n8n Microsoft Entra ID credentials — docs.n8n.io → Microsoft Entra ID
n8n Microsoft Teams node — docs.n8n.io → Teams node

With the registration in place, the Microsoft 365 (Graph) section covers calling Graph directly from cURL, Python, Next.js, Node.js and PHP using the same client ID and secret.

Registering a Microsoft Entra App for n8n to Reach Microsoft 365 and Teams