- Overview
- Setup Guide
- Permissions
- Troubleshooting
Create an Azure AD app registration to connect Parable to Microsoft 365 using OAuth 2.0 client credentials. This enables secure, automated access without user sign-in.
Data streams
This Provider Plugin defines 0 data streams.| Stream | Description | Sync |
|---|---|---|
| — | No customer-selectable data streams are declared. | — |
App registration
What You’ll Need
| Credential | What it is |
|---|---|
| Tenant ID | Azure AD tenant identifier |
| Client ID | Application (client) ID |
| Client Secret | Generated client secret |
Info: Setup access in Azure. These steps require Administrator, or a colleague with equivalent permissions who can create credentials for you. If that is not you, ask your Azure administrator.
- Global Administrator or Application Administrator role in Azure AD
- Permission to grant admin consent for API permissions
Step 1: Access Azure Portal
- Navigate to Azure Portal
- Go to Azure Active Directory → App registrations
- Click New registration
Step 2: Register Application
| Field | Value |
|---|---|
| Name | Parable Integration |
| Supported account types | Accounts in this organizational directory only |
| Redirect URI | Leave blank (not needed for client credentials) |
Step 3: Note Application Details
From the Overview page, copy:- Application (client) ID
- Directory (tenant) ID
Step 4: Create Client Secret
- Go to Certificates & secrets
- Click New client secret
- Add description:
Parable Integration Secret - Select expiration (recommend: 24 months)
- Click Add
Warning: Copy the secret Value immediately - it won’t be shown again!
Step 5: Configure API Permissions
- Go to API permissions
- Click Add a permission → Microsoft Graph
- Select Application permissions
- Add these permissions:
| Permission | Purpose |
|---|---|
User.Read.All | Read all user profiles |
Directory.Read.All | Read directory data (also covers org metadata and channel list when present) |
Team.ReadBasic.All | Read Microsoft Teams details |
Channel.ReadBasic.All | List Teams channels (required if Directory.Read.All is not granted) |
ChannelMessage.Read.All | Read Teams channel messages via the Teams export API |
ChannelMember.Read.All | Read Teams channel membership |
AuditLog.Read.All | Read sign-in and directory audit logs |
AuditLogsQuery.Read.All | Read Microsoft Purview audit log queries |
Mail.Read | Read mail (if needed) |
Calendars.Read | Read calendars (if needed) |
Warning:ChannelMessage.Read.Allis a protected Teams export permission. Admin consent alone is not enough: Microsoft must also approve protected-API access for your app, and your tenant needs Teams message export eligibility. See Microsoft’s Export content with the Microsoft Teams export APIs guide. Until that is in place, leave the Parablechannel_messagestap disabled (it ships opt-in).
Step 6: Grant Admin Consent
- Click Grant admin consent for [Your Org]
- Confirm the consent dialog
Info: All permissions should show a green checkmark indicating consent was granted. Channel / message taps that ship disabled stay off until you enable them in Parable after consent and protected-API approval succeed.
Step 7: Enter values in the form
- Tenant ID, Client ID, and Client Secret: Paste the Directory (tenant) ID, Application (client) ID, and client secret value.
- Click Save & test connection.
Get Access Token
curl -X POST "https://login.microsoftonline.com/{TENANT_ID}/oauth2/v2.0/token" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "client_id={CLIENT_ID}" \
-d "client_secret={CLIENT_SECRET}" \
-d "scope=https://graph.microsoft.com/.default" \
-d "grant_type=client_credentials"
Test API Access
curl -H "Authorization: Bearer {ACCESS_TOKEN}" \
"https://graph.microsoft.com/v1.0/users?\$top=5"
Success: Success! If you received a 200 OK response with valid data, your credentials are configured correctly. You can now configure this Provider in Parable.
Tip: Enter Tenant ID, Client ID, and Client Secret in the Provider form, then click Save & test connection.
App registration
| Permission | Data Accessed |
|---|---|
User.Read.All | User profiles, managers, photos |
Directory.Read.All | Groups, org hierarchy, devices; sufficient for listing channels when granted |
Team.ReadBasic.All | Microsoft Teams names, settings, and membership counts |
Channel.ReadBasic.All | Channel list (standard / private / shared) when Directory.Read.All is not used |
ChannelMessage.Read.All | Channel message content via Teams export APIs (protected API; Global cloud only - not US Gov L4/L5 or China 21Vianet) |
ChannelMember.Read.All | Teams channel member lists |
AuditLog.Read.All | Sign-in logs, directory audits |
AuditLogsQuery.Read.All | Purview audit log records (SharePoint/OneDrive file operations) |
Mail.Read | Email metadata and content |
Calendars.Read | Calendar events and availability |
Info: Channel message export covers public and private channels. Shared-channel coverage follows Microsoft Graph’s getAllMessages behavior and may omit some shared-channel traffic. 1:1 and group chats are not included in this Provider version.
Tip: Rate Limits: Microsoft Graph enforces rate limits of 10,000 requests per 10 minutes per app; throttling returns 429 with Retry-After header. Parable handles rate limiting automatically with exponential backoff, but initial syncs of large datasets may take longer due to these limits.This Provider Plugin does not declare any data streams.
| Error | Meaning | Solution |
|---|---|---|
AADSTS700016 | App not found | Verify Client ID and Tenant ID |
AADSTS7000215 | Invalid client secret | Regenerate client secret |
AADSTS65001 | Consent not granted | Grant admin consent for permissions |
403 Forbidden | Missing permission | Add required API permission and grant consent |