# (IDP-Email forwarding) Configure OAuth for Outlook Attachments (Microsoft Graph)

**URL:** <https://community.nextw.com/t/idp-email-forwarding-configure-oauth-for-outlook-attachments-microsoft-graph/1873>\
**Category:** Nextworld Platform\
**Tags:** intelligence, Document-Processing, IDP\
**Created:** [March 24, 2026, 7:36pm UTC](https://community.nextw.com/t/idp-email-forwarding-configure-oauth-for-outlook-attachments-microsoft-graph/1873 "2026-03-24T19:36:05Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kailey](https://sea1.discourse-cdn.com/flex001/user_avatar/community.nextw.com/kailey/32/266_2.png) [@Kailey](https://community.nextw.com/u/Kailey)\
**Post date:** [March 24, 2026, 7:36pm UTC](https://community.nextw.com/t/idp-email-forwarding-configure-oauth-for-outlook-attachments-microsoft-graph/1873/1 "2026-03-24T19:36:05Z")

</div>

This configuration is part of the email forwarding feature available for the platform. **This configuration step is only required for Power Automate flows which use email attachments** , and occurs after you:

- Configure your Webhook Setup record in the Nextworld platform. Learn more in the _ **Automate email forwarding with webhooks** _ topic in Nextworld Help.
- Configure your Power Automate flow. Learn more in [(IDP-Email forwarding) Power Automate Setup for forwarding emails into the platform](https://community.nextw.com/t/idp-email-forwarding-power-automate-setup-for-forwarding-emails-with-attachments-into-the-platform/1882).

**Microsoft Graph OAuth Setup**

To set up your endpoint and permissions for an Outlook account, you can use either Application permissions or Delegated permissions.

_Prerequisites_

- Microsoft 365 or Azure account with premium

- Admin access

_Step 1 — Register an Application_

1. Go to [Microsoft Entra admin center](https://entra.microsoft.com/)
2. Navigate to Application Registrations and select **New Registration**
3. Enter an application name
4. Select the appropriate supported account type (typically Single tenant)
5. Select **Register**

Copy the following from the Application Overview page:

- Tenant ID
- Client ID

_Step 2 — Create a Client Secret_

1. Open the registered application
2. Navigate to Certificates & Secrets
3. Select **New Client Secret**
4. Choose an expiration period
5. Select **Add**
6. Record the Secret value.

_Step 3 - API permissions_

For Delegated permissions:

1. Navigate to API Permissions
2. Select **Add a Permission**
3. Choose **Microsoft Graph**
4. Select **Application Permissions**
5. Add Mail.Read, offline\_access, openid, profile, User.Read (all type = Delegated)
6. Select **Grant Admin Consent**. You may need a system administrator to allow this.

For Application permissions:

1. Navigate to API Permissions
2. Select Add a permission
3. Choose **Microsoft Graph**
4. Select **Application Permissions**
5. Add Mail.Read - type Application

_Step 4 - Authentication_

If you are using delegated permissions, add a redirect URL such as _h ttps://{yourdomainname}/_  
For example, [https://apps.nextworld.net/](https://apps.nextworld.net/ "https://apps.nextworld.net/")

**Platform Configuration Steps**

_Delegated Microsoft Permissions:_

In the **Endpoint Definitions** application, open the _InboundEmails_ record and enter the endpoint URL: [https://graph.microsoft.com/v1.0/me/messages/{UNSOEmailMessageId}/attachments/{UNSOEmailAttachmentId}/$value](https://graph.microsoft.com/v1.0/me/messages/%7BUNSOEmailMessageId%7D/attachments/%7BUNSOEmailAttachmentId%7D/$value)

Then, navigate to the **OAuth Setup** application and create a record of type **Authorization Code** with:

- **3rd Party OAuth2 Auth Server URL** : Retrieve from your configuration in Azure or Microsoft 365. It will be formatted like _h ttps://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/authorize_ with your personal tenant-id in the curly brackets.

- **3rd Party OAuth2 Access Token URL** : _h ttps://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token_ with your personal tenant-id in the curly brackets.

- **Client ID** : Retrieve from your configuration in Azure or Microsoft 365.

- **Scope** : openid profile offline\_access User.Read Mail.Read

- Select the **Exclude Fragment** checkbox.

_Application Microsoft Permissions:_

In the **Endpoint Definitions** application, open the _InboundEmails_ record and enter the endpoint URL: [https://graph.microsoft.com/v1.0/users/{UNSOEmailRecipients}/messages/{UNSOEmailMessageId}/attachments/{UNSOEmailAttachmentId}/$value](https://graph.microsoft.com/v1.0/users/%7BUNSOEmailRecipients%7D/messages/%7BUNSOEmailMessageId%7D/attachments/%7BUNSOEmailAttachmentId%7D/$value) in the Endpoint Definition record.

Then, navigate to the **OAuth Setup** application and create a record of type **Client Credentials** with:

- **3rd Party OAuth2 Auth Server URL** : Retrieve from your configuration in Azure or Microsoft 365. It will be formatted like _h ttps://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/authorize_ with your personal tenant-id in the curly brackets.

- **3rd Party OAuth2 Access Token URL** : _h ttps://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token_ with your personal tenant-id in the curly brackets.

- **Client ID** : Retrieve from your configuration in Azure or Microsoft 365.

- **Scope** : [https://graph.microsoft.com/.default](https://graph.microsoft.com/.default)