Microsoft 365
Connect LOKI to Microsoft Entra ID – for signing in with Microsoft, taking over groups, and for SharePoint and Outlook.
The connection to Microsoft 365 is the basis for everything that links LOKI with Microsoft:
- Sign-in with Microsoft: employees sign in with their Microsoft work account.
- Microsoft groups: LOKI takes over the groups from Microsoft Entra ID and keeps them up to date.
- SharePoint and Outlook build on it.
You find the settings under Integrations on the Microsoft 365 card. Only administrators have access.
What you need from your Microsoft administration
For the connection, LOKI needs an app registration in Microsoft Entra ID. It is created by the person who manages Microsoft 365 in your organisation. From them you get the Tenant ID, the Client ID and a Client secret, and for SharePoint also a client certificate. The dashboard names the permissions the app registration needs on the pages of the individual integrations.
Setting up the connection
Open the “Connection” tab
Open Integrations › Microsoft 365, Connection tab.
Enter the credentials
- Tenant ID: the identifier of your Microsoft tenant.
- Client ID: the application ID of the app registration.
- Client secret: the secret key of the app registration. LOKI stores it encrypted and does not show it again afterwards. If you leave the field empty when editing later, the stored secret is kept.
Add the certificate (for SharePoint)
Under Client certificate (optional), select the two files that your Microsoft
administration created: the private key (.key) and the certificate (.cer).
Alternatively, paste both as text. The certificate is only needed for SharePoint (see
SharePoint).
Enable and save
Tick Enabled and click Save. Afterwards it says “Microsoft Entra ID is configured.”
When Enabled is ticked, the Sign in with Microsoft button appears on the sign-in page of the chat and the dashboard. If you untick it, the button disappears again. Only accounts from your own Microsoft tenant can sign in.
Keeping an eye on the certificate
After saving, the dashboard shows the certificate's Thumbprint and how long it is valid:
- “Valid until …”: everything is fine.
- “Expires in … days”: appears 30 days before expiry. Obtain a new certificate in good time and add it. A new one replaces the old one.
- “Expired on …”: SharePoint site groups are no longer resolved, and files that are shared only through such groups can no longer be found by anyone.
LOKI does not accept a certificate that has already expired; the previous one then stays in place. Use Remove certificate to delete it the next time you save.
Signing in with Microsoft
When a person signs in with Microsoft for the first time, LOKI automatically creates an account for them. This account
- has no LOKI password; signing in always goes through Microsoft,
- automatically gets the SharePoint search tool, anew at every sign-in,
- sees documents and uses tools through its Microsoft groups and LOKI groups.
Automatic group assignment
In the Groups tab, under Automatic group assignment, you set which LOKI groups new Microsoft accounts join automatically. For each LOKI group, choose None, Member or Manager and click Save.
This only applies to accounts that sign in for the first time from now on. It does not change existing accounts.
Microsoft groups
LOKI regularly takes over the groups from Microsoft Entra ID, including nested groups. In the Groups tab, under Microsoft groups, you see each group with the number of its members and documents. Clicking a group shows its documents.
These groups are view-only: you maintain members in Microsoft. You assign tools to them under Groups.
Default tools
In the Default tools tab, you set which tools every Microsoft group gets that LOKI sees for the first time. After that, you can change each group's tools individually.
If Microsoft groups already exist, LOKI asks “Apply to existing groups too?” when you save:
- New groups only: the existing groups stay as they are.
- Also … existing groups: existing groups get newly added tools and lose removed ones. Tools that a group was given individually stay unchanged.
Take care with Outlook e-mail
If you tick Outlook e-mail in the default tools, the members of every new Microsoft group get access to their own mailbox in the chat. This should be a deliberate decision.
Synchronization
The Synchronization tab shows the sync with Microsoft Entra ID: when it last ran and with what result. Use Sync now to start it immediately, for example after you have changed groups in Microsoft. The display is the same as for watched folders.
If the sync does not succeed for 24 hours, the overview page shows a warning. Until it works again, blocked Microsoft accounts and removed group memberships do not reach LOKI. In that case, check with your Microsoft administration whether the client secret and the permissions of the app registration are still valid.