@libai168/dsh-tool-microsoft-365

Authentication and configuration

Provide a delegated Microsoft Graph OAuth access token through the host configuration. The token must be kept outside source control and is never returned by a tool.

- name: '@libai168/dsh-tool-microsoft-365'
  config:
    accessToken: 'replace-with-a-short-lived-delegated-graph-token'
    # timeoutMs: 15000

See examples/cordis.yml. The client accepts only the production https://graph.microsoft.com/v1.0 endpoint. This prevents a Bearer token from being sent to an arbitrary configured host. OAuth acquisition and refresh belong in the host application.

Recommended delegated permissions are the smallest set needed by the tools you enable:

Capability	Microsoft Graph delegated permission
ms_auth_test, ms_get_profile	User.Read
ms_search_messages	Mail.Read
ms_list_calendar_events, ms_list_calendar_view	Calendars.Read
ms_search_drive_items, ms_get_drive_item	Files.Read
ms_search_chat_messages	Chat.Read

Microsoft Entra consent and Conditional Access policies can require administrator approval. A token with fewer permissions returns the Graph status and a sanitized error code.