# Microsoft 365 Delegated Access The Microsoft 365 Delegated Access integration is a Microsoft-sanctioned Enterprise app that allows users to grant Torq access to the resources that their own Microsoft 365 account can access. The permissions required are limited but sufficient to handle common Microsoft 365 use cases. This does not include access to shared mailboxes. This integration can be used with steps of the following Microsoft services, provided the integrated account has access to them: - Microsoft Excel - Microsoft OneDrive - Microsoft Outlook - Microsoft SharePoint If you don't see a step you need, you can [create your own](https://kb.torq.io/en/articles/9183207-creating-custom-steps-in-torq-automate-anything) in various ways, such as using the Send an HTTP Request step or Torq’s Step Builder, and share it across your organization. Create a [Microsoft 365](https://kb.torq.io/en/articles/10287213-microsoft-365) integration for non-delegated access with more specificity in permissions, services, and scopes. To [trigger](https://kb.torq.io/en/articles/9130865-integration-triggers-in-torq-ingest-data) a Torq workflow based on events sent from Microsoft 365 (using the Graph trigger integration), look [here](https://kb.torq.io/en/articles/9380201-microsoft-365-graph-subscription). ​ To use Microsoft 365 [steps](https://kb.torq.io/en/articles/9122841-explore-torq-steps-workflow-building-blocks) in Torq workflows using Delegated Access, look [here](#h_e2a06f8388). # **Use Microsoft 365 Steps with Delegated Access in Torq** ## **Step One: Create a Microsoft 365 Delegated Access Steps Integration in Torq** Best practice is to provision a dedicated (service) account for Microsoft 365 delegated access rather than using a *specific* user's account. In this case, you must create the integration from incognito mode - or a browser where you are not logged into your personal Microsoft account - and enter the dedicated account's details. 1. **Navigate to Integration:** In Torq, go to **Build > Integrations > Steps > Microsoft 365 Delegated Access**, and click **Add**. 2. **Name the Integration**: Type a meaningful name for the integration instance. You cannot change this later. 3. **Finalize:** Click **Add**. 4. **Accept Permissions**: If you are using a dedicated account, you will be directed to log in now. If you are using an SSO account that you are already logged into, you may be redirected to a Microsoft permissions page that displays the access that will be granted to Torq. 1. Click **Accept**. 2. Admins in Microsoft can give consent on behalf of your organization. If an admin has chosen this option, other users in the Torq workspace will still need to create their own integrations to generate a token, but they won't be redirected to a permissions page. 1. The following is a list of permissions granted to the integration: ``` offline_access openid emailprofile User.Read Files.ReadWrite.All Mail.ReadWrite Mail.Send Calendars.ReadWrite Contacts.ReadWrite MailboxSettings.ReadWrite Sites.ReadWrite.All ``` If you're asked to get admin approval when creating this integration, your organization may have restrictions on adding third-party apps. Ask your admin to check the Azure Active Directory (AAD) settings for the following, as this is needed to create the integration without admin approval. ![Screenshot showing admin access being required to create the integration in Torq.](https://torqio.intercom-attachments-1.com/i/o/1007550647/63292abc8cc1376364e54ba2/m365-del-access-allow-user-consent.png?expires=1793573100&signature=68ef0d574bc5d3ee12b2258e464880325df79c42034209bf0bcb4ae784badf6f&req=dSAnEcx7nYdbXvMW1HO4zRY5eTo8A2gfdcVZchtjZKeeG08JCv8C4REy2UOv%0A2GNsBPrb0K8yOn9pWfA%3D%0A) ## Step Two: Use the Integration in Torq Steps - Once you've created a Microsoft 365 Delegated Access integration in Torq, you can use it in Microsoft 365 steps. - In parameters that request a **Microsoft Access Token**, provide: `{{$.integrations..access_token}}` ![](https://downloads.intercomcdn.com/i/o/eomhaz2o/1304146631/0ffc0409bcb8f848a33679521846/image.png?expires=1793573100&signature=f74964006ac2191b38163f0d2eb2939f26038fee4bdb1a40b41c2504ef4ea644&req=dSMnEsh6m4dcWPMW1HO4zVvE%2FMjP6SUwsHU%2FhPFtQqXa0PWJsB9nJvqRPZeQ%0A5D8C%0A) --- # **FAQs** - [Send Emails with Inline Images in Microsoft Outlook](https://kb.torq.io/en/articles/9297456-send-emails-with-inline-images-in-microsoft-outlook) - [Trigger a Workflow in Torq when Files in Microsoft OneDrive Folder are Changed](https://kb.torq.io/en/articles/9828706-trigger-a-workflow-in-torq-when-files-in-microsoft-onedrive-folder-are-changed) - [Send and Refresh Adaptive Card in Outlook Email](https://kb.torq.io/en/articles/9024679-send-and-refresh-adaptive-card-in-outlook-email) - [Setup Delegated Access to a Microsoft Application using OAuth2](https://kb.torq.io/en/articles/9024678-setup-delegated-access-to-a-microsoft-application-using-oauth2) ## **Reauthorize Your Integration:** - Occasionally, your token may go out of sync. If you notice step failures, go to **Build > Integrations > Steps > Microsoft 365 Delegated Access**, click on your integration, and click **Reauthorize.** ![](https://downloads.intercomcdn.com/i/o/eomhaz2o/1304141716/4e69d347d736bcd638086114ff92/image.png?expires=1793573100&signature=d5289a2aab84900a57f173770c1bef1e0f537256dea9283b7bf406507053862f&req=dSMnEsh6nIZeX%2FMW1HO4zfwMZrMl4TihV4WUJAZstNnc95bqybGd0NEFJvNJ%0AFobS%0A) --- # **Templates** Now that you've added the step integration check out these specially crafted templates by Torq's security experts. Visit Torq's template library for [more](https://app.torq.io/templates?). - [Send a Microsoft Outlook Email to Assignee in a Torq Case](https://app.torq.io/templates?id=f656ebe4-fb3c-408f-a3d3-f4fb5e15c89f) - [Interactive Email Conversation (Microsoft 365)](https://app.torq.io/templates?id=af00a513-29a7-41a7-b0a1-972babdf3de2) - [Monitor an Outlook Mailbox for Phishing via Graph Subscription](https://app.torq.io/templates?id=aff69b2f-c262-4c95-800a-9979cf17ad3f) ​