schakl.
All integrations

Microsoft 365 Available

Microsoft 365

You connect Microsoft 365 with your own app registration in Microsoft Entra: configured per organisation, connected per employee. Signing in with Microsoft and connecting Microsoft are two separate grants — a login through Microsoft does not hand the app your calendar, OneDrive or mailbox.

What you need

  • A Microsoft 365 tenant and the right to create an app registration in it
  • A licence key covering the Microsoft 365 module (Instellingen → Licentie)
  • The microsoft.settings.manage permission for the settings page; admin only by default
  • For the Outlook timeline, the Contactmomenten (interactions) module as well, a separate licence
  • If an access proxy sits in front of your host (Cloudflare Access, for instance), a bypass for <code>/api/v1/microsoft/calendar/webhook</code>. Those notifications come from Microsoft's servers rather than a browser, so without one they are silently turned away.

How to connect it

  1. 1 Switch Microsoft 365 on under Instellingen → Integraties (Settings → Integrations). Without a covering licence the module goes read-only after the grace period and its own background jobs stand down.
  2. 2 In the Microsoft Entra admin center, create an app registration for your agency. Under supported account types prefer your own organisation only, and under API permissions add the delegated permissions User.Read, offline_access, Calendars.ReadWrite, Files.ReadWrite.All and Mail.Read.
  3. 3 Open Instellingen → Microsoft 365 (Settings → Microsoft 365). The first field is the Redirect-URI, derived from your environment's own hostname and never typed by hand. Copy it with the Kopiëren button and paste it under Authentication → Web → Redirect URIs on your app registration.
  4. 4 On the same page, fill in the Application (client) ID, the Client secret (stored encrypted; note its end date, an Entra secret expires) and optionally the Directory (tenant), and under Onderdelen tick the surfaces employees will be asked to grant: Agenda, OneDrive, Outlook-mail.
  5. 5 Under OneDrive-indeling fill in the Drive-ID (a SharePoint document library or a OneDrive), the Bovenliggende map voor klantmappen (ID) and optionally the Sjabloonmap (ID), pick an Automatiseringsaccount and tick Maak automatisch een map voor elke nieuwe klant. Under Outlook-beleid, decide whether newly matched emails wait for approval or are captured straight away.
  6. 6 Then have every employee connect themselves: Instellingen → Mijn account, card Microsoft-account, button Microsoft koppelen. With Outlook mail enabled, the checkbox Koppel ook mijn mailbox (Outlook) sits alongside it.

Signing in with Microsoft is not connecting Microsoft

Single sign-on with Microsoft (Instellingen → Single sign-on) and the connection to the calendar, OneDrive and the mailbox are two separate grants with separate lifetimes. Even an agency that has everyone sign in through Microsoft still needs each employee to press <strong>Microsoft koppelen</strong> for themselves. It works the other way round too: your login never quietly gains the right to read your mail. The connection deliberately asks for no sign-in claims: who you are, schakl. reads from Microsoft Graph after consent, with the token it stores anyway.

Calendar and OneDrive, day to day

The Agenda gains a source <strong>Outlook-agenda</strong> carrying your own events, read from schakl.'s cache and never live from Microsoft; extra calendars are ticked on your own account card and each get their own colour. In the other direction, approved leave and tasks planned onto someone's calendar are written into that person's own Outlook calendar. The <strong>OneDrive</strong> panel appears on clients, projects and tasks; it browses live as the viewing user inside the document library or OneDrive you configured, so Microsoft 365's own permissions stay authoritative.

  • Create a subfolder, upload files straight to OneDrive, and link an existing file to a record
  • Unlinking removes only the link; Verwijderen uit OneDrive moves the file to the OneDrive or SharePoint recycle bin
  • A client folder made from a template is one copy of the template folder, subfolders included

Outlook mail: metadata first, the body later

Every five minutes the worker reads each opted-in mailbox forward from where it left off, fetches metadata only, and logs messages whose participants match a known contact outside the agency. They arrive as pending touchpoints in the queue <strong>Interacties → E-mails te beoordelen</strong>, where the mailbox owner approves, rejects or remaps them to the right client or project. Only after approval is the body fetched from Microsoft. A message an inbox rule moved to a subfolder on arrival is seen too: the worker reads the whole mailbox, not just the Inbox.

  • Switched on per person with Mijn e-mail vastleggen in het CRM, plus an Outlook category that is never logged
  • A message the worker skipped can be fetched afterwards by an Outlook link, a message ID or the Message-ID, or found by searching your own mailbox
  • A remote image in a message is dropped: loading a tracking pixel would tell the sender the mail was opened
  • A colleague's mail to your agency's task address is read from their own sent mail and becomes a task on their board; such a mail does not land on the client timeline

Permissions

Grant these to the role that manages this integration (Settings → Roles). Admin-only by default, and never to the client role.

  • microsoft.settings.manage Manage the Instellingen → Microsoft 365 page and run the folder backfill for existing clients. Admin only by default.
  • microsoft.connection.manage Connect and disconnect your own Microsoft account. Admin and member by default.
  • microsoft.calendar.read See the Outlook-agenda source inside the Agenda.
  • microsoft.onedrive.read Browse a client's OneDrive folder and see the linked files.
  • microsoft.onedrive.write Link and unlink files, upload, and create folders.
  • microsoft.onedrive.manage Change or detach a record's OneDrive folder. Admin only by default.

What it deliberately does not do

  • Per-user connections only: every employee connects themselves. An application permission that reads every mailbox in the tenant is deliberately not offered.
  • Outlook mail is read-only. schakl. never sends mail through Outlook; outgoing post uses the transport under Instellingen → E-mail.
  • Calendar sync writes one way. Outlook events are only read, and the sync looks a year ahead; anything beyond that arrives at the cache's next restart.
  • The first poll of a mailbox imports nothing and only records a starting point. Existing mail is never fetched retroactively.
  • Microsoft offers no way to revoke the access from inside schakl.: disconnecting deletes the stored tokens, and you remove the app's access yourself at myapps.microsoft.com.
  • OneDrive links are references, not copies, and folders are configured by pasting a drive and folder ID because there is no folder picker yet.

Where to find it Instellingen → Microsoft 365 (Settings → Microsoft 365) for the organisation, Instellingen → Mijn account (Settings → My account, card Microsoft-account) for your own connection, plus the OneDrive panel on a client, project or task and the queue Interacties → E-mails te beoordelen (Interactions → Emails to review).

Read the guide

Other integrations

Mollie Stripe Adyen Exact Online SnelStart Timeon