Connect Microsoft 365 to Liman (Entra)

Updated: August 2026
Audience: Tenant admins and IT who enable Microsoft 365 (calendar, mail, Teams chat, files, Planner) in Liman.

Sprache / Language: Deutsch

Users connect Microsoft under Settings → Accounts & organisations. For that sign-in to succeed, the Entra app registration must list the exact redirect URI.

This is not Liman sign-in (OIDC/Keycloak, URIs /callback and /silent-renew). This page is only Microsoft Graph inside the app.

Which app registration?

Situation	What you do
Default Liman app (application ID `942842e4-9ef4-448a-b565-a655390d2d74`)	Liman maintains the redirect URIs. In your tenant, grant admin consent for the enterprise application / API permissions.
Your own app registration in your tenant	You must add the redirect URIs yourself (next sections).

Platform: Single-page application only

Microsoft Entra admin center → Identities → Applications → App registrations → your app.
Authentication → Add a platform.
Choose Single-page application — not Web, not Mobile and desktop applications.

Liman uses authorization code with PKCE in the browser. Web or desktop platforms later cause AADSTS9002326.

Do not enable implicit grant.

Redirect URIs

The URI must match exactly (scheme, host, port, path). The path is always /redirect.html. An origin with no path is not enough.

Environment	Redirect URI (SPA)
Local development (port 5173)	`http://localhost:5173/redirect.html`
Your web app	`https://{your-app-host}/redirect.html`
Liman production (reference)	`https://app.liman.com/redirect.html`
Liman preview (reference)	`https://preview.liman.com/redirect.html`
Installed desktop app	`https://tauri.localhost/redirect.html`

After saving, wait 2–5 minutes, then connect Microsoft in Liman again.

What Entra will not accept

Entra allows HTTP only for the host localhost. tauri.localhost does not count.

Do not add (the portal rejects these on every platform):

http://tauri.localhost/redirect.html
http://tauri.localhost/

Switching to Web or Desktop does not change that rule.

Scenario	What to register
Web and local development	`http://localhost:5173/redirect.html` and `https://{app-host}/redirect.html`
Installed desktop app	`https://tauri.localhost/redirect.html` (SPA). `sparks://…` is an app deep link, not an Entra SPA redirect URI. Do not add `http://tauri.localhost/…`.

Checklist

Platform Single-page application
Production URI: https://{app-host}/redirect.html
Local (if needed): http://localhost:5173/redirect.html
Installed desktop: https://tauri.localhost/redirect.html
No http://tauri.localhost/… entries
On sign-in errors, add the exact URI from the error message

Typical errors

Error	Cause	Fix
`AADSTS50011` / `redirect_uri_mismatch`	URI missing or different	Add the exact URI under SPA
`AADSTS9002326`	URI under Web or Desktop	Put the same URI under SPA
Portal: must be HTTPS or `http://localhost`	`http://tauri.localhost/…`	Do not add it; use the table above

Which app registration?​

Platform: Single-page application only​

Redirect URIs​

What Entra will not accept​

Checklist​

Typical errors​

See also​