Microsoft 365

Connect Microsoft 365 to keep each client's users and licenses up to date: who works there, which licenses they've bought, how many are assigned, when they renew, and who has each one.

This is separate from signing in with Microsoft. Sign-in is for your team; this reads your clients' tenants.

#What's synced

• Guests are never synced. By default, disabled accounts and users without a license (shared mailboxes, rooms, service accounts) are left out too. You can change both under What to sync.
• Each contact shows its licenses under related items, because the license's Assigned to field links to them.
• Licensed accounts that aren't contacts, such as disabled users still holding a license, are listed on the license under Other licensed accounts. It's a quick way to spot licenses you're paying for but not using.
• Renewal dates feed expiry alerts, like any date field marked to track expiry. See Notifications.
• Free and self-service licenses that every tenant collects, such as Power Automate Free and Teams Exploratory, are skipped.

Like every integration, the sync only adds and updates. Notes, tags and fields you add yourself are left alone, and nothing is ever deleted. Contacts that already exist are matched by email, then by name.

#1. Register an app in your own tenant

Do this once, in your own (MSP) Microsoft Entra tenant, not a client's.

1. In the Microsoft Entra admin center, go to Applications → App registrations → New registration.
2. Name it, for example Knowpoint documentation sync.
3. Under Supported account types, choose Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant).
4. Under Redirect URI, choose Web and paste the address shown on the Microsoft 365 connection page in Knowpoint. It ends in /admin/m365/consented.
5. Select Register, and copy the Application (client) ID.
6. Go to API permissions → Add a permission → Microsoft Graph → Application permissions, and add:
   • User.Read.All: users and their licenses
   • Organization.Read.All: the tenant's name, domains and licenses
   • LicenseAssignment.Read.All: renewal dates
7. Go to Certificates & secrets → New client secret. Copy the secret's Value (not its ID), and note when it expires.

#2. Connect it in Knowpoint

1. Go to Admin → Integrations → Microsoft 365.
2. Paste the Application (client) ID and Client secret, choose what to sync, and select Save and continue.

#3. Add each client tenant

On the connection's page, under Client tenants:

• Add with admin consent: you're sent to Microsoft. Sign in as the client's Global Administrator and accept the permissions. Microsoft sends you back, and the tenant is added. You can also send the link to the client's admin.
• Add by tenant ID or domain: if the app was already consented another way, enter the tenant ID or a domain such as contoso.onmicrosoft.com.

Then select Match tenants to check which organization each tenant syncs into, and 🔄 Sync now.

Removing a tenant stops it syncing. What it synced is kept.

#Troubleshooting

• "The app isn't consented in this tenant yet": use Add with admin consent while signed in as that tenant's admin. Microsoft can take a few minutes after consent before the app can sign in.
• "The client secret is wrong or has expired": create a new secret on the app registration and save it on the connection.
• "Microsoft Graph refused …": a permission is missing. Add it to the app registration, then consent again in each tenant so the new permission is granted there too.
• No renewal dates: add LicenseAssignment.Read.All and consent again.
• One tenant failing doesn't stop the others. Its problem is shown on the connection page after the sync.