Productivity Activities

Last updated May 21, 2025

How to connect to Microsoft 365 activities

Overview

Microsoft 365 activities have different authentication flows that you can choose from. Your choice is dependent on the following:

The type of automation mode you plan to run, attended or unattended.
The type of project you want to build, Windows or cross-platform.
The type of permissions you want to grant, delegated or app-only.
Whether you use Integration Service or not.
Your application authentication requirements.
Note: Consult with your administrator if you are unsure which authentication requirements apply to your application.

The following table explains the basic differences between each authentication type:

Microsoft Authentication flow	Microsoft 365 Scope authentication type	Integration Service authentication type	Robot type - Unattended	API permission type
OAuth 2.0 authorization code flow	OAuth 2.0 Authorization code - Public App (Interactive Token)	OAuth 2.0 Authorization code	(only with Integration Service)^*	Delegated permissions
OAuth 2.0 authorization code flow	OAuth 2.0 Authorization code - Custom OAuth Application - Bring your own app (Interactive Token)	Bring your own OAuth 2.0 app	(only with Integration Service)^*	Delegated permissions
Integrated Windows authentication (IWA)	Integrated Windows Authentication	N/A		Delegated permissions
Username and password	Username and password	N/A		Delegated permissions
OAuth 2.0 client credentials flow	Application ID and secret	OAuth 2.0 client credentials		Application permissions
OAuth 2.0 client credentials flow	Application ID and certificate	N/A		Application permissions

^* Integration Service keeps the connection token alive by refreshing the token. After a certain period of time, you must manually refresh the connection by re-authentication.

To learn about the specifics of each option, check the following pages:

Permission types and differences

The permissions can be of the following types:

Delegated permissions
Application permissions

To understand the differences between these permissions, check the official Microsoft documentation.

Briefly, the differences are as follows:

With Delegated permissions, the application impersonates a user and acts on behalf of the user. The application can access only what the signed-in user can access.
With Application permissions, the application acts on its own, without a signed-in user. The application can access any data that its permissions are associated with.

For both delegated and application permissions, you can restrict what the application can and cannot access using the scopes defined when you create the app. For more details, check the Scopes and permissions in the Microsoft documentation.

Tip: Refer to Working with activity scopes to learn how to control permissions using activity scopes.

Admin consent

Many organizations require the consent of an administrator before creating a connection to an external application. The admin consent workflow requires an admin to approve the app registration to specific users or groups before a connection is established. For more details, check Overview of admin consent workflow and User and admin consent in Microsoft Entra ID in the Microsoft documentation.

Multi-tenant and single-tenant applications

Both Microsoft 365 Scope and Integration Service connections support single-tenant applications and multi-tenant applications. To learn the difference between them, refer to Who can sign in to you app? in the Microsoft official documentation.

Azure environments

Both Microsoft 365 Scope and Integration Service connections support multiple Azure environments. For details, check Microsoft Graph and Graph Explorer service root endpoints.

Microsoft National Cloud	Environment in Integration Service	Environment in Microsoft 365Scope
Microsoft Graph global service	Default	Azure, Azure Global
Microsoft Graph for US Government L4	US Government L4	US Government
Microsoft Graph for US Government L5	US Government L5	N/A
Microsoft Graph China	China	China