Three Clio Operate integrations with Office 365 need an app registration in Microsoft Entra: authentication, SharePoint Online as your document management system, and outbound email. This article covers the steps all three share and explains what differs for each.

You can create one app registration per integration, or reuse a single registration for multiple integrations. If you reuse one, see Using one registration for more than one integration below, because the registration needs every redirect URI and every permission those integrations use.

The app registration lets Clio Operate use OAuth 2.0 instead of storing your Office 365 credentials. For what that means for MFA and Conditional Access, see O365 Integration: Overview.

Before you start

• Permission in Microsoft Entra to create an app registration. If your tenant allows self-service registration, any user can do this. If it does not, you need the Application Developer role.
• Permission in Microsoft Entra to grant admin consent, if your tenant requires it. Any of the Privileged Role Administrator, Cloud Application Administrator, AI Administrator or Application Administrator roles can do this.
• The redirect URI for the integration you are configuring. See the table below. For authentication, your project team provides the identity server address.

What each integration needs

Use this table alongside the steps that follow.

Create the app registration

1. Open the Microsoft Entra admin centre at https://entra.microsoft.com.
2. Navigate to Entra ID > App registrations.
3. Select New registration.
4. Enter a name for the application. Clio recommends a name that identifies the environment and the integration, for example Clio Operate [environment] - Exchange Online.
5. Select Accounts in this organisational directory only.
6. Select Register.

Add the redirect URI

The platform type must be Web. Clio Operate requests the authorisation response as a form POST, and a single-page application registration or a public client registration rejects a form POST. Linking then fails.

1. From the left-hand menu, select Authentication.
2. In the Redirect URIs section, add a redirect of type Web.
3. Set the value to the redirect URI for your integration, from the table above.
4. Select Save.

For authentication only, you must also allow Clio Operate to receive an ID token. On the same Authentication page, under Settings > Implicit grant and hybrid flows, select ID tokens. Do not select Access tokens.

Create a client secret

Required for SharePoint Online and for outbound email. Optional for authentication.

You cannot retrieve a client secret after you leave the page, so copy it as soon as you create it.

1. From the left-hand menu, select Certificates and secrets.
2. Create a new client secret and give it a description.
3. Set an expiry. You cannot create a secret that never expires, and the maximum is 24 months. Microsoft recommends less than 12 months.
4. Copy the secret value and store it safely.

Record the expiry date and renew the secret before it lapses. When a secret expires, the integration that uses it stops working until you replace the value in Clio Operate.

Add the API permissions

Clio Operate acts on behalf of a signed-in user, so it needs delegated permissions rather than application permissions. In some organisations, these permissions require admin consent.

1. From the left-hand menu, select API permissions.
2. Add the delegated permissions for your integration from the table above.
3. If your tenant requires it, grant admin consent for the permissions.

Each permission then displays as granted.

Add only the permissions that your integration uses. Outbound email, for example, does not need Mail.ReadWrite, because it never writes to mailbox contents.

Gather the values you need

Select Overview from the left-hand menu and copy the following.

Using one registration for more than one integration

One app registration can serve two or three of the integrations. It is not enough to point the second integration at an existing registration, because each integration uses a different redirect URI and a different set of permissions.

To reuse a registration, add everything that each integration needs:

• Every redirect URI. A registration can hold more than one. Authentication uses your identity server address, while SharePoint Online and outbound email both use https://[your-Clio-Operate-instance]/externalServices/replyFrom, so a registration serving all three needs two redirect URIs.
• Every permission. Add the permissions from each row of the table that applies to you, then grant admin consent once.
• A client secret, if any of the integrations you are combining require one.

If you would rather keep the integrations independent, create a separate registration for each. Separate registrations let you grant narrower permissions and rotate secrets without affecting the other integrations.

What invalidates the tokens

Once an account is linked, Clio Operate holds a refresh token rather than a password. Two things end that token, and when they do, the account must be linked again. This applies to every integration that uses the app registration.

Inactivity. A refresh token expires after 90 days of inactivity. Microsoft sets this period and it cannot be changed.

A password reset, depending on where it is done. Clio Operate registers as a confidential client, because the platform type is Web and it uses a client secret. For confidential clients, Microsoft treats password changes differently according to where they happen.

Plan for this when you rotate the password on an account that Clio Operate uses. Resetting it from either admin centre stops that integration working until someone links the account again, so schedule the re-link at the same time.

Clio Operate does not remove links on a schedule. It removes one the next time it needs a token and Microsoft refuses the refresh, so the failure surfaces at the point of use.

Related articles

• Using O365 for Authentication
• SharePoint Online as DMS
• Sending Emails from Clio Operate