[setup] Register the Jaah Microsoft 365 OAuth

**User-only setup task.** Only a person can do the registration steps below (a human sign-in at the vendor). Runner: do NOT attempt the vendor-side steps and do not open a PR. Ask the operator once through AskUserQuestion (header `Human act`) to do the steps; when they say it is done, run **Runner validation** on dev and settle `no_pr` / `no_code_needed`, citing the observed Connect + Test result (never a secret value). If validation fails, name the step that looks wrong and ask once more. A person must do this: registering an app in Microsoft Entra needs a human sign-in. It lets members connect Microsoft 365 to Jaah with one **Connect Microsoft 365** button. ## Steps 1. Sign in to Microsoft Entra with the account that should own Jaah's app (a shared company account, never a personal one), and open: https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade 2. Create a new OAuth app. Name it **Jaah**. 3. Select New registration, enter the name Jaah, and under Supported account types choose Any Entra ID Tenant + Personal Microsoft accounts. 4. Under Redirect URI choose the platform Web and enter the first redirect URI below, then select Register; add the second on the app's Authentication page under Web > Redirect URIs. 5. Open Certificates & secrets > Client secrets > New client secret, describe it as Jaah and choose 24 months; copy its Value (not the Secret ID) at once - it is shown only once. Note the expiry date: renew it before then. 6. Open API permissions > Add a permission > Microsoft Graph > Delegated permissions and add offline_access, User.Read, Calendars.ReadWrite, Mail.Read, Mail.Send, Files.Read.All, Sites.Read.All and Chat.Read. None of them needs admin consent, so leave Grant admin consent unselected. 7. Open Branding & properties: set the logo, the home page, terms of service and privacy statement URLs to the Jaah website, its terms and its privacy policy, and the publisher domain jaah.ai. 8. Complete publisher verification (Branding & properties > Publisher verification) with Jaah's Microsoft Partner Center account, so users of other organizations see a verified publisher and are not blocked from consenting. 9. Redirect URIs exactly as written: `https://app.dev.jaah.ai/api/credentials/connect/callback` (dev) and `https://app.jaah.ai/api/credentials/connect/callback` (prod). 10. Request exactly these scopes: `offline_access`, `User.Read`, `Calendars.ReadWrite`, `Mail.Read`, `Mail.Send`, `Files.Read.All`, `Sites.Read.All`, `Chat.Read`. 11. Copy the app's client ID and client secret. Keep them in your password manager only until the next step is done. 12. In the Jaah console of each environment (dev first, then prod), open **Secrets**, select **New**, and create an **OAuth app** (`oauth_app`) secret on the operator plane named `jaah-microsoft_365-app`, with provider `microsoft_365`, the client ID and the client secret. 13. Open **Settings > Integrations > OAuth apps > Microsoft 365** and pick that secret in the knob `oauth_app.microsoft_365`. 14. Never paste the client ID or secret into this task, a comment, a chat or an email. Reply here only with what you did. ## Scopes and why | Scope | Why Jaah asks for it | |---|---| | `offline_access` | Stay connected: lets Jaah renew access without asking you again | | `User.Read` | Read your profile, so the connection shows whose it is | | `Calendars.ReadWrite` | Read your calendar and create events when a task asks for it | | `Mail.Read` | Read your mail, for tasks that work from your inbox | | `Mail.Send` | Send mail as you when a task asks for it | | `Files.Read.All` | Read OneDrive and shared files agents are pointed at | | `Sites.Read.All` | Read SharePoint sites, lists and documents | | `Chat.Read` | Read your Teams chats for context | ## Review or verification Publisher verification is needed for users in other organizations to consent without an admin; until it is done, their admins must grant consent for their tenant. ## Runner validation On dev, **Connect Microsoft 365** with the Jaah app ends on **Connected** and **Test** passes. Read only the result, never the secret. ## Out of scope No code change. Do not edit the vendor spec, the catalog engine or any other credential. Never paste a client ID or secret anywhere. ## Done means - The operator confirmed the steps are done. - On dev, the vendor's Connect screen no longer says "Jaah app not configured", consent ends on **Connected**, and **Test** passes — cited from what you observed.