Set Up Your Outlook App

# 1. Sign in with an account in the mailbox's tenant. --allow-no-subscriptions lets a
#    Microsoft 365 tenant with no Azure subscription sign in; add --tenant yourdomain.com
#    if your account belongs to several tenants.
az login --allow-no-subscriptions

# 2. Create a single-tenant app with Hiveku's redirect URI
APP_ID=$(az ad app create --display-name "Hiveku Mail" --sign-in-audience AzureADMyOrg \
  --web-redirect-uris https://app.hiveku.com/api/oauth/microsoft/callback --query appId -o tsv)
echo "$APP_ID"

# 3. Add the Microsoft Graph permissions Hiveku asks for
GRAPH=00000003-0000-0000-c000-000000000000
for PERMISSION in Mail.ReadWrite Mail.Send offline_access User.Read; do
  PERMISSION_ID=$(az ad sp show --id $GRAPH --query "oauth2PermissionScopes[?value=='$PERMISSION'].id" -o tsv)
  az ad app permission add --id "$APP_ID" --api $GRAPH --api-permissions "$PERMISSION_ID=Scope"
done

# 4. Create the client secret (printed once; it expires in 2 years)
az ad app credential reset --id "$APP_ID" --append --display-name hiveku --years 2 --query password -o tsv

# 5. Your tenant id, for connecting
az account show --query tenantId -o tsv