Setting up Application Programming Interface (API) access utilizing the Workflows API Connector functionality connects Okta to the Microsoft Graph API. This configuration allows administrators to add scopes that are not included in the out-of-the-box Microsoft Connectors within Workflows and enables connections via Client Credentials.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Workflows
• Application Programming Interface (API) 
• Microsoft Graph API
• API Connection

How is a Microsoft Graph API connection created using OAuth 2.0?

Two methods exist to connect to Azure/Entra: Authorization Code (Delegated permissions) or Client Credentials (App-only permissions). Delegated permissions require that both the app and the authorizing user have permissions to perform any actions taken by the connection. App-only permissions require setting permissions for the app itself, not for a particular user. The current built-in Azure connector in Okta Workflows utilizes Delegated permissions.

Authorization Code (Delegated Permissions)

Create an application in the Microsoft Entra Admin Center, generate a client secret, assign delegated permissions, and configure the Okta API connection by following these instructions.

1. Create an app within the Microsoft Entra Admin Center.
   1. To create an app in the Microsoft Entra admin center, follow the instructions to register an application with the Microsoft identity platform and add a Web platform application type.
   2. When creating the Web platform application type, use the following Redirect URIs for the Redirect URI in Okta Workflows Preview and Production orgs, respectively:
      • Preview: https://oauth.workflows.oktapreview.com/oauth/httpfunctions/cb
      • Production: https://oauth.workflows.okta.com/oauth/httpfunctions/cb
2. Create and record a Client Secret for the app: Option 2: Add a client secret.
   • Record the Client Secret (labeled Value in the UI) to use later when setting up the Connection in the Workflows Console.
3. Add Delegated permissions to the created app to access Microsoft Graph.
   • Delegated Permissions use the Authorization code grant flow and sign in on behalf of a user.
   • Select the permissions the client app requires on behalf of the signed-in user.
     1. Add the offline_access scope to get a refresh token.
     2. Add User.Read.All from the endpoint.
     3. Add other scopes as needed.
4. Configure the Okta API Connection.
   1. Log in to the Okta Workflows console.
   2. Click Connections, select New Connection, and choose API Connector.
   3. Provide a name for the Connection.
   4. Select OAuth for the Auth Type and enter the following details:
      • Access Token Path: Found under the application's Overview, then Endpoints (OAuth 2.0 token endpoint (v2)).
      • Authorize Path: Found under the application's Overview, then Endpoints (OAuth 2.0 authorization endpoint (v2)).
      • Client ID: Found under the application's Overview, then Application (client) ID.
      • Client Secret: Use the client secret value saved earlier.
      • Scope: Add scopes in the format offline_access user.read.all.
        • NOTE:
          • Separate multiple scopes with a space.
          • In some cases, instead of entering the scope name, like user.read.all, enter the full scope, like https://graph.microsoft.com/User.Read. The full scope includes both the resource identifier and the permission name, providing a clear and complete picture of the access requested. The scope name only includes the permission name and is used when the resource is already well-known or implied by the context.
5. Click Create.
   • A prompt appears to log into Microsoft and grant access.

At this point, the connection succeeds. To confirm, perform a GET request to the following API Endpoint to list users: https://graph.microsoft.com/v1.0/users.

Client Credentials (App-only Permissions)

Register a web application in the Microsoft Entra Admin Center, generate a client secret, assign application permissions, and configure the Okta API connection using client credentials by completing these steps.

1. Create an app within the Microsoft Entra Admin Center.
   1. To create an app in the Microsoft Entra admin center, follow the instructions to register an application with the Microsoft identity platform and add a Web platform application type.
   2. When creating the Web platform application type, use the following Redirect URIs for the Redirect URI in Okta Workflows Preview and Production orgs, respectively:
      • Preview: https://oauth.workflows.oktapreview.com/oauth/httpfunctions/cb
      • Production: https://oauth.workflows.okta.com/oauth/httpfunctions/cb
2. Create and record a Client Secret for the app: Option 2: Add a client secret.
   • Record the Client Secret (labeled Value in the UI) to use later when setting up the Connection in the Workflows Console.
3. Add any Application permissions necessary to perform the intended actions with the connection.
4. Configure the Okta API Connection.
   1. Log into the Okta Workflows console.
   2. Click Connections, select New Connection, and choose API Connector.
   3. Provide a name for the Connection.
   4. Select Client Credentials for the Auth Type and enter the following details:
      • Access Token Path: Found under the application's Overview, then Endpoints (OAuth 2.0 token endpoint (v2)).
      • Client Authentication Type: Select Send as basic auth header. If this fails, attempt the Send as basic auth body option.
      • Client ID: Found under the application's Overview, then Application (client) ID.
      • Client Secret: Use the client secret value saved earlier.
      • Scope: This depends on the required permissions. One option is to use https://graph.microsoft.com/.default as the scope. This value informs the Microsoft identity platform endpoint to include all the app-level permissions the admin consented to in the access token.
5. Click Create.
   • Okta successfully creates the connection.

Related References

• How to Authenticate with HTTP Cards Okta Workflows
• Delegated permissions
• App-only permissions
• Register an application with the Microsoft identity platform
• Option 2: Add a client secret
• Admin consent button