Skip to main content

​
About Microsoft Graph

Microsoft Graph connects Serval to Microsoft 365 and Entra ID through the Microsoft Graph API, giving your workflows and ingestion access to Entra ID users and groups, enterprise applications, Microsoft Intune device management, license and subscription management, mail and calendar, and SharePoint/OneDrive content for the Serval knowledge base. Anything in the Microsoft Graph API surface can be reached through Serval’s proxied request layer, subject to the permissions you grant. Authentication: Sign in with Microsoft (OAuth 2.0 with delegated permissions - recommended), or a Custom Application (OAuth 2.0 client credentials with application permissions) for advanced setups. Data sync: Background sync of Entra ID users, Entra Security Groups (full sync every 16 hours, delta every 4), Entra Microsoft 365 Groups (full sync every 8 hours, delta every 4), and enterprise applications with their app role assignments - plus continuous indexing of SharePoint and OneDrive content as a knowledge source.

​
What the Microsoft Graph integration enables

CapabilityDescription
Entra ID user directory syncIngests all Entra ID (Azure AD) users on a recurring schedule so they are available throughout Serval.
Entra group sync and membership provisioningSyncs Entra Security Groups (access control - full sync every 16 hours, delta every 4) and Entra Microsoft 365 Groups (collaboration - full sync every 8 hours, delta every 4) as separate resource types, each with a Member entitlement. Serval can add or remove users from either group type for access requests and provisioning workflows.
Enterprise application syncIngests Entra enterprise applications and their app role assignments, mapping who has access to which app.
Microsoft Intune device managementRead Intune managed devices, configuration policies, apps, RBAC, and service settings. With the read/write preset, manage Intune and perform privileged device actions such as wipe and retire.
SharePoint and OneDrive knowledge baseIndexes SharePoint sites and OneDrive document libraries as a Serval knowledge source for AI answers.
License and subscription managementRead directory and subscription data, and read or update license assignments from workflows.
Mail and calendar automationRead, write, and send mail and manage calendars from workflows.
Groups, Teams, and guest access actionsCreate teams, manage groups, and invite or manage external guests in Microsoft Teams teams and channels from workflows.
Full Microsoft Graph API accessAny Microsoft Graph API endpoint can be called from workflows through Serval’s authenticated proxied requests, subject to the permissions granted to the connection.
Anything defined in the Microsoft Graph API can be accessed through Serval.
Looking for Microsoft Teams help desk and channel automation, or Exchange Online management? Those are separate integrations with their own pages: Microsoft Teams and Exchange Online.

​
Get your credentials

​
Connect in Serval

​
Verifying the connection

Serval runs five health checks against your Microsoft Graph connection. Test Microsoft Graph Connection - Verifies Serval can authenticate by deliberately requesting a Graph resource that doesn’t exist: a “resource not found” reply proves the token is valid. This check tests only authentication, never permissions.
  • Success: “Microsoft Graph authentication token is valid and working”
  • Failure: “Could not get a valid authentication token for Microsoft Graph. Please check your Client ID, Client Secret, and Tenant ID configuration.”
List Microsoft Graph Users - Confirms Serval can list users from your directory (up to 100).
  • Success: “Successfully listed [number] users from Microsoft Azure AD”
  • Failure: “Unable to list users from Microsoft Azure AD.” followed by a status-specific hint - for a permissions (403) failure: “The Microsoft Graph app may not have the required permissions. Check the app’s permission configuration in Azure AD.”
List Microsoft Graph Groups - Confirms Serval can list groups from your directory (up to 100).
  • Success: “Successfully listed [number] groups from Microsoft Azure AD”
  • Failure: “Unable to list groups from Microsoft Azure AD.” followed by the same status-specific hints as the users check.
List Intune Managed Devices - Confirms Serval can list managed devices from Microsoft Intune (up to 10). Requires the DeviceManagementManagedDevices.Read.All permission.
  • Success: “Successfully listed [number] managed devices from Microsoft Intune”
  • Failure: “Unable to list managed devices from Microsoft Intune. This health check requires the DeviceManagementManagedDevices.Read.All permission.”
Check SharePoint Online License - Verifies your Microsoft 365 tenant has a SharePoint Online license and the root site is accessible, which SharePoint knowledge base ingestion requires.
  • Success: “SharePoint Online is licensed and the root site is accessible”
  • Failure (no license): “This Microsoft 365 tenant does not have a SharePoint Online license. SharePoint knowledge base ingestion requires an active SPO license. Please assign a SharePoint Online license to the tenant, or remove the SharePoint knowledge source to stop sync failures.”
  • Failure (permissions): “The Microsoft Graph app does not have permission to access SharePoint sites. Ensure the Sites.Read.All or Sites.ReadWrite.All permission is granted.”
If the connection test is green but the users, groups, Intune, or SharePoint checks fail, your credentials are fine - it’s a permissions problem. The connection test only validates authentication. Reconnect with the right presets (Sign in with Microsoft) or add the missing application permissions and re-grant admin consent (Custom Application).

​
Gotchas and troubleshooting

The form field is literally labeled Client secret value - paste the secret’s Value, not the Secret ID. The value is only visible in Azure immediately after creation. Expired secrets are surfaced explicitly (AADSTS700082):
The client secret for application ‘<client ID>’ has expired. Please generate a new client secret in the Azure Portal and update it in Serval.
Other authentication failures you may see (invalid_client, then the generic fallback):
Client authentication failed for application ‘<client ID>’. Please verify the Client ID and Client Secret are correct.
Failed to authenticate with Microsoft Graph for tenant ‘<instance name>’. Please verify your Client ID, Client Secret, and Tenant ID in the Azure Portal.
Fix: create a new client secret in Certificates & secrets, copy its Value immediately, and update it in Serval.
The scope presets in the connect modal only apply to the Sign in with Microsoft (delegated) flow. A Custom Application uses application permissions: its effective access is exactly the application permissions granted on the app registration. To get the equivalent of a preset, add the matching permissions under API permissions → Microsoft Graph → Application permissions and grant admin consent.
The OAuth flow uses Microsoft’s multi-tenant “organizations” sign-in endpoint, which accepts work or school accounts only - the connect modal explicitly says “Connect using your Microsoft work or school account.” Personal Microsoft accounts cannot be used. (Details: Microsoft identity platform endpoints.)
The List Intune Managed Devices check fails without the DeviceManagementManagedDevices.Read.All permission. Check the Microsoft Intune (Read-only) preset during OAuth connect, or grant the DeviceManagement* application permissions on a custom app. The Read/write preset additionally enables privileged device actions (wipe, retire) via DeviceManagementManagedDevices.PrivilegedOperations.All.
SharePoint knowledge ingestion requires an active SharePoint Online license on the tenant - the SharePoint license health check verifies this by probing the root site. Either assign an SPO license or remove the SharePoint knowledge source to stop the sync failures. Access also requires the Sites.Read.All (or Sites.ReadWrite.All) permission.
This is intentional. Serval ingests Entra Security Groups (access control; members can include users, devices, service principals, and nested groups; full sync every 16 hours) and Entra Microsoft 365 Groups (collaboration; user members only; full sync every 8 hours, since collaboration groups change more often) as distinct resource types with different sync schedules and approval semantics. Don’t expect them to be merged.
For Sign in with Microsoft: just reconnect. Serval pre-selects your currently granted permissions as checked presets plus individual extras, and Microsoft re-confirms the full set on every connect - so check the new preset, re-consent, done. For a Custom Application: add the application permissions on the app registration and re-grant admin consent; no change is needed in Serval.
They live elsewhere. Microsoft Teams help desk and channel automation is the dedicated Microsoft Teams integration, and Exchange Online (PowerShell) management is the Exchange Online integration - each has its own docs page.
Need help? Contact support@serval.com for assistance with your Microsoft Graph integration.