From c127c308dd6ce9527157dd06fb6a1f601cff2d44 Mon Sep 17 00:00:00 2001 From: Niek Rabelink Date: Tue, 8 Sep 2026 19:46:15 +0200 Subject: [PATCH 1/3] feat: kopieerbare v2.0 admin consent link voor IT-beheerders toegevoegd --- integrations.php | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/integrations.php b/integrations.php index 551efb4..e8fd4d1 100644 --- a/integrations.php +++ b/integrations.php @@ -315,7 +315,7 @@ $redirectUri = rtrim(APP_URL, '/') . '/auth/callback_microsoft.php'; $curClientId = !empty($outlookSettings['client_id']) ? $outlookSettings['client_id'] : fociz_env('MICROSOFT_CLIENT_ID', ''); $curTenantId = !empty($outlookSettings['tenant_id']) ? $outlookSettings['tenant_id'] : 'organizations'; if (!empty($curClientId)): - $adminConsentUrl = "https://login.microsoftonline.com/" . urlencode($curTenantId) . "/adminconsent?client_id=" . urlencode($curClientId) . "&redirect_uri=" . urlencode($redirectUri); + $adminConsentUrl = "https://login.microsoftonline.com/" . urlencode($curTenantId) . "/v2.0/adminconsent?client_id=" . urlencode($curClientId) . "&redirect_uri=" . urlencode($redirectUri) . "&scope=" . urlencode("https://graph.microsoft.com/.default"); ?>
@@ -390,16 +390,25 @@ $redirectUri = rtrim(APP_URL, '/') . '/auth/callback_microsoft.php'; $curClientId = !empty($outlookSettings['client_id']) ? $outlookSettings['client_id'] : fociz_env('MICROSOFT_CLIENT_ID', ''); $curTenantId = !empty($outlookSettings['tenant_id']) ? $outlookSettings['tenant_id'] : 'organizations'; if (!empty($curClientId)): - $adminConsentUrl = "https://login.microsoftonline.com/" . urlencode($curTenantId) . "/adminconsent?client_id=" . urlencode($curClientId) . "&redirect_uri=" . urlencode($redirectUri); + $adminConsentUrl = "https://login.microsoftonline.com/" . urlencode($curTenantId) . "/v2.0/adminconsent?client_id=" . urlencode($curClientId) . "&redirect_uri=" . urlencode($redirectUri) . "&scope=" . urlencode("https://graph.microsoft.com/.default"); ?>
-
+
Krijgt u "Beheerdersgoedkeuring vereist"? - In Azure staat de goedkeuring standaard op 'Niet verleend'. Open deze directe link als beheerder om het met 1 klik goed te keuren:
- - Beheerdersgoedkeuring direct verlenen via Microsoft → - + Stuur deze officiële Microsoft goedkeuringslink naar uw IT-beheerder om Fociz met 1 klik goed te keuren voor : +
+ + +
+
+ + Zelf beheerder? Open de goedkeuring direct → + +
From 08e16b30067a4604b525fe0bb73ee0c4eb4d4149 Mon Sep 17 00:00:00 2001 From: Niek Rabelink Date: Tue, 8 Sep 2026 20:07:54 +0200 Subject: [PATCH 2/3] fix: vereenvoudig Microsoft OAuth scopes tot enkel consented rechten (User.Read Calendars.Read offline_access) --- includes/integrations/microsoft.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/includes/integrations/microsoft.php b/includes/integrations/microsoft.php index f45992d..d1b5150 100644 --- a/includes/integrations/microsoft.php +++ b/includes/integrations/microsoft.php @@ -10,7 +10,7 @@ require_once __DIR__ . '/../../config/database.php'; const MS_OAUTH_AUTHORIZE_URL = 'https://login.microsoftonline.com/%s/oauth2/v2.0/authorize'; const MS_OAUTH_TOKEN_URL = 'https://login.microsoftonline.com/%s/oauth2/v2.0/token'; const MS_GRAPH_BASE_URL = 'https://graph.microsoft.com/v1.0'; -const MS_DEFAULT_SCOPES = 'offline_access openid profile email User.Read Calendars.Read'; +const MS_DEFAULT_SCOPES = 'offline_access User.Read Calendars.Read'; /** * Genereert de Microsoft OAuth2 login URL From 09cc85fcc1fc53a7b5c3dc0b0bb4af2e1c28638a Mon Sep 17 00:00:00 2001 From: Niek Rabelink Date: Tue, 8 Sep 2026 20:09:28 +0200 Subject: [PATCH 3/3] fix(microsoft): update requested scope to Calendars.ReadWrite to match Azure admin consent --- includes/integrations/microsoft.php | 2 +- integrations.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/includes/integrations/microsoft.php b/includes/integrations/microsoft.php index d1b5150..dea416c 100644 --- a/includes/integrations/microsoft.php +++ b/includes/integrations/microsoft.php @@ -10,7 +10,7 @@ require_once __DIR__ . '/../../config/database.php'; const MS_OAUTH_AUTHORIZE_URL = 'https://login.microsoftonline.com/%s/oauth2/v2.0/authorize'; const MS_OAUTH_TOKEN_URL = 'https://login.microsoftonline.com/%s/oauth2/v2.0/token'; const MS_GRAPH_BASE_URL = 'https://graph.microsoft.com/v1.0'; -const MS_DEFAULT_SCOPES = 'offline_access User.Read Calendars.Read'; +const MS_DEFAULT_SCOPES = 'offline_access User.Read Calendars.ReadWrite'; /** * Genereert de Microsoft OAuth2 login URL diff --git a/integrations.php b/integrations.php index e8fd4d1..d809995 100644 --- a/integrations.php +++ b/integrations.php @@ -309,7 +309,7 @@ $redirectUri = rtrim(APP_URL, '/') . '/auth/callback_microsoft.php';

4. Maak een geheim aan onder Certificaten en geheimen.

-

5. Voeg API-machtigingen toe: Calendars.Read, User.Read, offline_access.

+

5. Voeg API-machtigingen toe: Calendars.ReadWrite, User.Read, offline_access.

6. Cruciaal voor organisaties: Klik direct boven de tabel met machtigingen op de knop "Beheerdersgoedkeuring verlenen voor [Organisatie]" (Grant admin consent) en bevestig met 'Ja'. Hiermee voorkomt u de melding "Beheerdersgoedkeuring vereist".