Microsoft Entra App Reference | MyQ X Help Center

This article summarizes the application registration models, authentication settings, redirect URIs, API permissions, and scopes used by MyQ integrations with Microsoft services.

Use this reference when:

registering an application manually
reviewing an automatically configured enterprise application
planning whether integrations can share an application registration
troubleshooting permissions, authentication, or consent

For the recommended automatic workflow, see Automatic Microsoft Entra App Registration.

Registration Models

Some integrations can be configured automatically from MyQ. Other integrations require a manual application registration in Microsoft Entra ID.

For Microsoft Entra ID, OneDrive for Business, and SharePoint Online, manual setup can use one shared application registration or separate application registrations for each integration.

Do not use a shared application with Microsoft Exchange Online or Universal Print.

Integration	Setup	Registration model	Client Secret	Public client flow
Microsoft Entra ID / Microsoft Graph	Automatic or manual	Shared or dedicated	Yes	No
OneDrive for Business	Automatic or manual	Shared with Entra ID/SharePoint, or dedicated	Yes	No
SharePoint Online	Automatic or manual	Shared with Entra ID/OneDrive, or dedicated	Yes	No
Exchange Online	Manual	Dedicated	No	Yes
Universal Print	Manual	Dedicated	No	Yes

Application Registration and Service Principal

A manually registered application is represented in two places in the Microsoft Entra admin center:

App registrations contains the application definition, including its identifiers, authentication settings, credentials, redirect URIs, and requested API permissions.
Enterprise applications contains the service principal representing the application in the customer’s tenant. Access, consent, and tenant-specific permissions are managed here.

Automatic setup creates and configures the service principal used by MyQ.

Redirect URIs

Microsoft Entra ID, OneDrive for Business and SharePoint Online use the following redirect URIs:

Integration or feature	Setup method	Platform	Redirect URI
Microsoft Entra ID / Microsoft Graph	Manual	Web	`https://{hostname:port}/auth`
Microsoft Entra ID SSO helper	Manual	Single-page application	`https://helper.myq.cz/openid/`
MyQ Desktop Client Seamless SSO	Manual, when used	Mobile and desktop applications	`ms-appx-web://microsoft.aad.brokerplugin/{Application-client-ID}`
OneDrive for Business	Manual	Web	`https://helper.myq.cz/`
SharePoint Online	Manual	Web	`https://helper.myq.cz/`
Microsoft Exchange Online	Manual	Mobile and desktop applications	`https://login.microsoftonline.com/common/oauth2/nativeclient`
Universal Print	Manual	Mobile and desktop applications	Select the mobile and desktop redirect URI in Microsoft Entra ID.

Replace:

{hostname:port} with the hostname and HTTPS port of the MyQ server.
{Application-client-ID} with the Application client ID of the application registration.

Exchange Online uses the following redirect URI:

Integration or feature	Setup method	Platform	Redirect URI
Microsoft Exchange Online	Manual	Mobile and desktop applications	`https://login.microsoftonline.com/common/oauth2/nativeclient`
Universal Print	Manual	Mobile and desktop applications	Select the mobile and desktop redirect URI in Microsoft Entra ID.

Universal Print uses the following redirect URI:

Integration or feature	Setup method	Platform	Redirect URI
Universal Print	Manual	Mobile and desktop applications	Select the mobile and desktop redirect URI in Microsoft Entra ID.

Connecting to the Application from MyQ

If you use automatic registration, MyQ gets the client and tenant information silently.

If you configure any integration manually, get these details from your application registration Overview page:

Application (client) ID
Directory (tenant)
Client secret (Entra ID, OneDrive for Business and SharePoint Online only)

Permissions Used During Automatic Setup

The permissions used to create and configure the application are separate from the permissions that the resulting application uses at runtime.

Automatic setup applies the following temporary permissions:

Permission	API	Type	Purpose
`Application.ReadWrite.All`	Microsoft Graph	Delegated	Create or update the connector application credential.
`Directory.Read.All`	Microsoft Graph	Delegated	Read tenant information, including the default domain name.

Runtime Permissions

Microsoft Entra ID Permissions

Microsoft Entra ID requires the following runtime permissions:

Permission	API	Type	Purpose
`Group.Read.All`	Microsoft Graph	Application	Read groups and group membership.
`User.Read.All`	Microsoft Graph	Application	Read users.
`User.Read`	Microsoft Graph	Delegated	Sign in and read the signed-in user's profile.

OneDrive for Business Permissions

OneDrive for Business requires the following runtime permissions:

Permission	API	Type	Purpose
`Files.ReadWrite`	Microsoft Graph	Delegated	Read and write files available to the signed-in user.
`User.Read`	Microsoft Graph	Delegated	Identify the signed-in user.
`Files.ReadWrite.All`	Microsoft Graph	Application	Access users' files without individual user authorization.

SharePoint Online Permissions

SharePoint Online requires the following runtime permissions:

Permission	API	Type	Purpose
`User.Read`	Microsoft Graph	Delegated	Identify the signed-in user.
`Sites.ReadWrite.All`	Microsoft Graph	Delegated	Read and write SharePoint content available to the signed-in user.
`Sites.Read.All`	Microsoft Graph	Delegated	Read sites in the tenant.
`Sites.ReadWrite.All`	Microsoft Graph	Application	Read and write content without individual user authorization.

Microsoft Exchange Online Permissions

Microsoft Exchange Online requires the following runtime permissions:

Permission	API	Type	Purpose
`User.Read`	Microsoft Graph	Delegated	Sign in and read the mailbox user's profile. Required for authentication.
`IMAP.AccessAsUser.All`	Microsoft Graph	Delegated	Read, update, create, and delete email in the user's mailbox. Required for Jobs via Email using IMAP. Does not include sending email.
`SMTP.Send`	Microsoft Graph	Delegated	Send email from the user's mailbox. Required for outgoing mail.

Microsoft Universal Print Permissions

Microsoft Universal Print requires the following runtime permissions:

Permission	API	Type	Purpose
`PrinterShare.ReadWrite.All`	Microsoft Graph	Delegated	Read and write printer shares.
`Printer.FullControl.All`	Microsoft Graph	Delegated	Register, read, update, and unregister printers.
`Printers.Create`	Universal Print	Delegated	Create and register printers.
`Printers.Read`	Universal Print	Application	Read printers without a signed-in user.
`PrinterProperties.ReadWrite`	Universal Print	Application	Read and write printer properties and attributes without a signed-in user.
`PrintJob.Read`	Universal Print	Application	Read print-job metadata and payload without a signed-in user.
`PrintJob.ReadWriteBasic`	Universal Print	Application	Read and write basic print-job metadata without a signed-in user.

Authentication Scopes

Authentication scopes are used during OAuth or OpenID Connect authentication.

Microsoft Entra ID / Microsoft Graph

Microsoft Entra ID (Microsoft Graph) requires the following authentication scopes:

Integration	Scope	Purpose
Microsoft Entra ID / Microsoft Graph	`openid`	Sign in the user and request an ID token.
Microsoft Entra ID / Microsoft Graph	`email`	Request the user's email claim.
Microsoft Entra ID / Microsoft Graph	`profile`	Request basic profile claims.

Microsoft Exchange Online

Microsoft Exchange Online requires the following authentication scope:

Integration	Scope	Purpose
Microsoft Exchange Online	`offline_access`	Allow MyQ to renew access without requiring the mailbox user to authenticate every time. Required for continued access.

Microsoft Universal Print

Microsoft Universal Print requires the following authentication scope:

Integration	Scope	Purpose
Universal Print	`offline_access`	Allow MyQ to use a refresh token to obtain new access tokens. Required for continued access.

See also in the Deployment guide:

See also in the MyQ Server guide: