Internal Research Only

One tenant token. No user sign-in.

A lab for a single question: can an organization-level access token (OAuth 2.0 client credentials) stand in for per-user delegated sign-in when reading mail, contacts, and calendars? Enter a tenant app registration to acquire one.

App-Only Token

Client credentials grant against .default, so there is no consent screen and no refresh token.

No /me Endpoint

Every call names a user explicitly: /users/{id} or the tenant directory.

Mail, Contacts, Calendar

Read any tenant user's messages, contacts, and events through server-side proxy routes.

Credentials Stay Client-Side

Tenant id, client id, and secret live in this browser's IndexedDB and are posted to /api/auth.

Before You Start

An Entra app registration in the target tenant, with a client secret.
Application permissions with admin consent granted: User.Read.All, Mail.Read, Contacts.Read, Calendars.Read. Delegated scopes will not work here.
The token is app-only and expires in about an hour. There is no refresh token, so submit the form again to renew.
The secret is stored in this browser, so use a throwaway registration and never production credentials.