Connecting Microsoft 365

Connecting Microsoft 365 unlocks three things in Rounds: read-only Email, read-write Calendar, and read-write Teams channels — all scoped to your practice's M365 tenant.

What you need

A Microsoft 365 admin for your tenant (Global Admin or Application Admin)
A user account on your tenant for day-to-day Rounds usage
~5 minutes for the admin, ~1 minute per user after

One admin grants tenant-wide consent; after that, every user in your tenant can connect without re-prompting:

Your Rounds onboarding email from Ralt Health includes a consent URL that looks like:

https://login.microsoftonline.com/common/adminconsent?client_id=66bf3e0f-...&state=<your-practice-slug>

Forward it to your M365 admin
Admin clicks the URL → signs in → reviews requested scopes → clicks Accept
Scopes: offline_access, User.Read, Mail.ReadBasic, Mail.Send, Calendars.ReadWrite, ChannelMessage.Send, Team.ReadBasic.All
Microsoft returns them to /admin/integrations/microsoft with a success banner

After admin consent, every other user in your tenant can use the integration without re-consenting.

Unverified publisher warning

Until Ralt Health completes Microsoft Cloud Partner verification (MCPP, ~1-3 week process), your admin will see an unverified publisher banner on the consent screen. This is cosmetic; the integration works identically. We post a milestone update to status.ralthealth.com when MCPP clears.

Per-user connection

After admin consent:

Each user clicks /admin/integrations/microsoft → Connect in their own Rounds session
No consent prompt (admin already consented); Rounds receives a token immediately
Token encrypted via libsodium + stored in the practice's vault (see ADR-004)
Token auto-refreshes every 45 minutes via cron

What Rounds sees

Email — read your inbox metadata + send messages on your behalf. We never read message bodies without user action, never forward messages, never bulk-scan.
Calendar — read your events + create new events (e.g., follow-up appointments from Patient Flow)
Teams — read channel metadata + send messages to channels you've joined

All operations are logged to the audit trail with user attribution.

Verifying the connection

Click Test Connection on the integrations page
Rounds calls GET /me against Graph API with your token → shows your display name + email
If it fails, the error surface names the issue (token expired, revoked consent, scope missing)

Disconnecting

Disconnect button wipes the token + sets status = disabled. The audit log retains the connection history.

If you hit a problem

Admin sees "need approval from your IT admin" — consent URL is wrong. Re-fetch from your onboarding email or ask support for a fresh one.
User sees AADSTS65001: The user or administrator has not consented — admin consent didn't land cleanly. Admin re-runs the consent URL.
Token expired unexpectedly — refresh cron may have failed; click Reconnect to mint a new one
Other: support@ralthealth.com

title: "Connecting Microsoft 365" description: "OAuth consent flow, what scopes we request, and how to verify the connection is working." order: 1 category: "integrations" updated_at: "2026-04-24"