Microsoft 365 support

Last updated date:

Connect, reconnect, and troubleshoot Microsoft 365 without sharing credentials or customer content through support channels.

1. Before you start

  • The currently available path is a customer-managed manual connection for a Microsoft 365 work or school tenant in the commercial/global cloud. Managed Microsoft OAuth, delegated user tokens, personal Microsoft accounts, and sovereign clouds are not supported yet.
  • Arrange access for a Seedling workspace administrator, Entra app-registration owner, and administrator authorized to consent to Microsoft Graph application permissions. SharePoint, Exchange, and Teams setup may also require their workload administrators.
  • Choose the exact Entra tenant, Seedling workspace, capability keys, and approved mailbox, drive, SharePoint site/library, and team containers before creating the app.
  • Create a dedicated app at Entra ID > App registrations > New registration. Choose Accounts in this organizational directory only (Single tenant), leave Redirect URI empty, register it, and record Directory (tenant) ID plus Application (client) ID from Overview—not Object ID.
  • At API permissions > Add a permission > Microsoft Graph, choose Application permissions, not Delegated permissions. Add only the roles mapped to the approved Seedling capabilities and remove the default delegated User.Read permission unless this dedicated app has another reviewed use.
  • For SharePoint, Sites.Selected admin consent initially grants access to no sites; a SharePoint administrator must grant this application read on every approved site. For scoped Outlook access, use Exchange Online Application RBAC and avoid leaving equivalent tenant-wide Entra grants in place.
  • Create or obtain a currently valid RSA certificate with at least 30 days remaining. Upload only its public PEM certificate to Entra; keep its private key secret and prepare one unencrypted PEM bundle containing the complete certificate and matching private-key blocks for Seedling.
  • Grant tenant admin consent only after reviewing the final list. Refresh API permissions and confirm that every required row says Application and Granted for the intended tenant.
  • Do not send Microsoft 365 credentials, customer content, personal information, or private record data by email or through an ordinary support ticket.
Microsoft Graph permissionsMicrosoft's current Graph permissions reference.

2. Connect Microsoft 365

  1. In the intended Seedling workspace, open Connections and select Microsoft 365. If Microsoft 365 is unavailable, contact Seedling support with the workspace name before creating credentials; a delegated token is not a fallback.
  2. Enter Directory (tenant) ID and Application (client) ID from the Entra app Overview page. Both are UUIDs; do not enter the app Object ID.
  3. Paste the entire combined PEM with one BEGIN CERTIFICATE block and its matching unencrypted RSA BEGIN PRIVATE KEY or BEGIN RSA PRIVATE KEY block. Do not paste a PFX/P12 file, encrypted key, access token, or public certificate by itself.
  4. Enter the approved Seedling capability keys, including required directory.identity, read and accept the versioned Microsoft data-use notice, and connect. Seedling verifies the app, certificate, and permissions before completing the connection.
  5. For Outlook, use Microsoft Graph Explorer to run GET /v1.0/users/{mailbox-email}?$select=id,displayName,userPrincipalName and copy the response's id. Add it as Outlook mailbox, then choose Mail, Primary calendar, or both.
  6. For OneDrive, run GET /v1.0/users/{owner-email}/drive?$select=id,name,webUrl in Graph Explorer. Check name and webUrl, then add the response's drive id as the OneDrive container.
  7. For SharePoint, resolve GET /v1.0/sites/{hostname}:/{site-path}?$select=id,displayName,webUrl, then run GET /v1.0/sites/{site-id}/drives?$select=id,name,webUrl. Add the chosen library drive id as the container and the complete comma-separated site id as its parent.
  8. For Teams, use the team's More options > Get link to team action in the work or school Teams client. Copy only the UUID after groupId= and add it as the team ID; do not enter a channel ID, chat ID, tenant ID, name, or full URL.
  9. Add sources one at a time and confirm that Seedling accepts each exact Microsoft ID and begins its initial synchronization.
  10. After the first sync, review Content access on every child connection. Outlook, OneDrive, SharePoint, and Teams keep Permissions from source and cannot be broadened in Seedling. Outlook mail follows the exact active user only for a Microsoft purpose user mailbox; shared and resource mailboxes infer no owner. Calendar records also follow Microsoft sharing/delegate roles, and only private-event delegates receive private events.

3. Authorization and connection problems

Admin consent required
On the app's API permissions page, confirm every required permission has Type Application and Status Granted for the intended tenant. Graph application permissions require an appropriately privileged administrator; an ordinary user or delegated consent is insufficient.
Setup unavailable
Microsoft 365 has not been made available for this Seedling workspace. Contact Seedling support with the workspace name; do not paste a delegated access or refresh token as a workaround.
Certificate rejected
Confirm the bundle contains a complete PEM certificate and its matching unencrypted RSA private key, that the public certificate is uploaded to this exact app, and that at least 30 days of validity remain. PFX/P12, encrypted PEM, EC keys, and mismatched pairs are rejected.
Tenant or application ID rejected
Copy Directory (tenant) ID and Application (client) ID from the app Overview page. Do not substitute Object ID, a tenant domain, an app secret ID, or an ID from another tenant.
Subsystem forbidden
Authentication succeeded but the workload denied access. Check the exact application role, SharePoint Sites.Selected read grant, Exchange App RBAC scope, Teams license, service availability, Conditional Access workload policy, and immutable source ID.
Source ID not found
Resolve the ID again in the same tenant. Outlook needs the user object's id, OneDrive and SharePoint libraries need drive ids, SharePoint also needs the complete parent site id, and Teams needs the backing group's groupId.

4. Missing or delayed data

  1. Identify whether the missing object belongs to Outlook, OneDrive, SharePoint, or Teams and confirm the matching Graph read permission.
  2. Confirm the exact immutable mailbox user, drive, SharePoint site/library, or team ID is selected; an email, display name, URL, or neighboring container is not equivalent.
  3. For a OneDrive 404, confirm the owner and license and have the owner open OneDrive once so Microsoft provisions it. For SharePoint, relist site drives and match both library name and webUrl.
  4. Check workload Conditional Access, Exchange App RBAC, Sites.Selected grants, private/shared channel membership, resource scoping, file permissions, supported V1 object types, and Teams licensing before treating the record as absent.
  5. Allow incremental synchronization and provider retry handling to complete. A temporary provider failure does not delete previously synchronized data.
  6. If the issue remains, contact support@tryseedling.ai with the Seedling workspace, safe timestamps, and non-sensitive provider record identifiers. Do not include credentials or record contents.

5. Rotate or replace access

Never use email or an ordinary support ticket to transfer the old or replacement credential.

  1. Generate or obtain a replacement RSA certificate before the current certificate has fewer than 30 days remaining. Verify its dates and that its public certificate matches its private key.
  2. Upload the new public certificate to the same Entra app while leaving the old certificate in place. Do not create a new app registration for routine rotation.
  3. Reconnect Microsoft 365 in Seedling using the same tenant ID, client ID, capabilities, and approved data-use purpose, but the replacement certificate/private-key PEM bundle.
  4. Confirm that the replacement certificate authenticates successfully and that every existing selected source remains available.
  5. Only after the replacement certificate works, remove the old public certificate from Entra and securely destroy retired private-key copies according to organizational policy.