Microsoft 365 Connections

This section provides you with information about how to configure Microsoft 365 Connections to allow users to send documents for review using Microsoft 365.

Prerequisites:

Microsoft 365 E3 or E5 subscription.
Azure Client ID, Client Secret, and Active Directory. Contact your IT administrator for these.
The IT Administrator has granted the following permission to the Conga CLM Azure application in addition to existing permissions. This is applicable for Application and Delegated flow.
- Permission: User.Invite.All

Configure one of the following flows in the Azure app:

Delegated Permission Flow

Application Permission Flow

(Optional) Configuring a Specific SharePoint Site

Create a SharePoint communication site. For more information, see Create a Site in SharePoint.

Tip:

You must use the site name from the URI as shown in the screenshot when you are configuring SharePoint 365 Site Setting in CLM.

Collecting the Azure client ID and Client Secret from the Azure Portal

Log in to the Azure portal as an administrator.
Select Azure Active Directory.
Select App registrations.
Select New registration and enter Conga CLM Application.
Click Register.
From the left navigation bar, select Overview.
Copy the Application (Client) ID and save it securely. You need it while configuring Microsoft 365 settings.
From the left navigation bar, select Certificates & secrets.
Click New client secret.
Add a description, select the validity duration, and select Add. The value of the client secret is displayed. Copy this value and save it securely. You cannot retrieve the key later.

Configuring Flows in the Azure App

You need to provide the required permissions to the Azure app for all the reviewers to allow the Azure app to create folders and files. You can use one of the following flows to facilitate interaction between the Azure app and SharePoint.

Application Flow: The Azure app can directly interact with SharePoint without a signed-in user present. The Azure app can access any data that the permission is associated with. For example, if the Azure app is granted the Files.Read.All application permission, it will be able to read any file in SharePoint. For more information, see Application permissions (Microsoft Documentation) and Application access (Microsoft Documentation).
Delegated Flow: The Azure app cannot interact with SharePoint without signed-in user present. Both the review initiator and the Azure app must have permission to create a folder or file and add permission in SharePoint. When sending a document for review, the review initiator must log in every time. Hence, this is a restrictive flow. For more information, see Delegated permissions (Microsoft Documentation) and Delegated access (Microsoft Documentation).

Application Permission flow

Select API permission under API Permission > Add permission > Microsoft Graph > Application Permission.

Provide the following permissions for Microsoft Graph APIs:


API Permission	Purpose	Alternate Permission for Restricted Access
User.Read.All	To fetch active Azure Active Directory users' email address, ID, and display name when the initiator adds reviewers on the Send for Review page. The system performs "contains search" on display name and email address, returning matching users as the initiator types.	User.Read.All
Files.ReadWrite.All	To allow upload, download, and deletion of files or folders in SharePoint, directly from the application. In addition, you can add reviewers within SharePoint, enabling documents to be reviewed and collaborated on using SharePoint's native review capabilities.	Sites.Selected Note: Ensure that the SharePoint admin has granted Azure app, write access to the configured SharePoint site. For more information, see Granting Access to SharePoint Site.
Sites.Read.All	To validate the configured SharePoint site.	Not applicable
User.Invite.All	To allow an application or a designated user to invite external guest users to the organization.	Not applicable

On the API Permissions page, click Grant admin consent for the permissions where "Admin consent required" is "Yes".

Delegated Permission flow

In the authentication tab from the Azure app that you had created in the previous configuration, add a URI with the org's instance URL and with "/apex/apttus__MSAuthorize" appended.

Sample value: https://test–tbox.my.salesforce.com/apex/apttus__MSAuthorize
Select API permission under API Permission > Add permission > Microsoft Graph > Delegated Permission.

Provide the following permissions for Microsoft Graph APIs:


API Permission	Purpose	Alternate Permission for Restricted Access
User.Read.All	To fetch active Azure Active Directory users' email address, ID, and display name when the initiator adds reviewers on the Send for Review page. The system performs "contains search" on display name and email address, returning matching users as the initiator types.	User.Read.All
Files.ReadWrite.All	To allow upload, download, and deletion of files or folders in SharePoint, directly from the application. In addition, you can add reviewers within SharePoint, enabling documents to be reviewed and collaborated on using SharePoint's native review capabilities.	Sites.Selected Note: Note Ensure that the SharePoint admin has granted Azure app, write access to the configured SharePoint site. For more information, see Granting Access to SharePoint Site.
Sites.Read.All	To validate the configured SharePoint site.	Not applicable
User.Invite.All	To allow an application or a designated user to invite external guest users to the organization.	Not applicable

On the API Permissions page, click Grant admin consent for permissions where "Admin consent required" is "Yes".

Configuring the Microsoft 365 Connections

Click the App Launcher () and select Admin Console.
In the left panel, click Integrations.
Click the Microsoft 365 Connections tab.
Click New.
Enter the following details to connect to Microsoft 365:
1. Name: Enter Microsoft 365.
2. MS Login URL: Enter the Microsoft 365 login URL to connect to the service. Sample value: https://login.microsoftonline.com/%3CTenantID%3E/oauth2/v2.0/
  To find Tenant Id, see How to find your Azure Active Directory tenant ID.
3. MS Graph URL: Enter the Microsoft 365 URL to connect to the service. Value: https://graph.microsoft.com/v1.0/
4. Scope: Enter the scope to be used in the Microsoft 365 Graph API.
  
  Tip: Ensure you add appropriate values per the configured authentication flow.
  
  For application flow (Permit Delegation is disabled in the Microsoft 365 setting): https://graph.microsoft.com/.default
  
  For delegated flow (Permit Delegation is enabled in the Microsoft 365 setting): offline_access Files.ReadWrite.All
5. Client Id: Enter the client ID. (Refer to step 7 in the previous configuration) Sample value: 8m7r4**d-****-4c**-b4d8-e4a6b***79b
6. Client Secret: Enter the client secret. (Refer to step 11 in the previous configuration) Sample value: taiLWUY*****38&7B%400$5234c***UY%
7. Show Client Secret: Select the checkbox to expose the Client Secret field value.
8. SharePoint Site: Enter the Microsoft SharePoint Site you use for Microsoft 365 review. (Ensure you do not enter the site URL. Sample value: CLMsite.
  For more information, see SharePoint Site Configuration.)
  Tip: The system uses the organization's default site if no SharePoint site is configured.
9. Folder Path: Enter the folder path to upload documents to SharePoint.Sample value: ContractDocuments
  
  Tip: If the folder path is blank, the system creates a folder named "Conga CLM Temp Folder" to store the documents to be reviewed.
10. Permit Delegation: After you log in to Microsoft, select the Permit Delegation checkbox, enabling users to grant delegate access.
  
  Tip:
  Select the Permit Delegation checkbox only if you configured your Azure app for delegated flow.
  
  Enabling the Permit Delegation toggle button also ensures that only authorized users send out the documents for review. Users are prompted for Microsoft email address and password, if they have logged out from their Microsoft account or if the token is expired.
Click Test Connection when the setting is active to check if all the entered values are correct.
Click Save.

Granting Access to SharePoint Site

You must have SharePoint administrator rights.
SharePoint SiteID is available.

To use Sites.Selected permission in Azure permissions, the SharePoint admin must grant Azure app, write access to the configured SharePoint site.

Register the target application in the Azure portal. Copy the Display name and Client ID value and save them securely. You need them when you assign the target application, permission to the SharePoint site.
Grant the target Application the following restricted access permissions:
- User.ReadBasic.All
- Sites.Selected
Using Microsoft Graph API, grant permissions to the target application for the SharePoint site. To do so, run the POST https://graph.microsoft.com/v1.0/sites/{siteId}/permissions Graph API Endpoint.
1. Make an API call with the following request body:

{

"roles": ["write"],

"grantedToIdentities": [

{

"application": {

"id": "YOUR_TARGET_APP_CLIENT_ID",

"displayName": "Target Application"

}

]

}

Conga Product Documentation

Welcome to the new doc site. Some of your old bookmarks will no longer work. Please use the search bar to find your desired topic.