AI-generated content
Transcribed
OAuth 2.0 - Simply Explained
Oct 28, 2026 ·
14m 8s
Download and listen anywhere
Download your favorite episodes and enjoy them, wherever you are! Sign up or log in now to access offline listening.
OAuth 2.0 - Simply Explained
Description
Every time you click Sign in with Microsoft, OAuth 2.0 keeps your password out of the app. This episode explains the four players, the flows, tokens and scopes, and how...
show more
Every time you click Sign in with Microsoft, OAuth 2.0 keeps your password out of the app. This episode explains the four players, the flows, tokens and scopes, and how it all works in Microsoft Entra ID and Microsoft Graph, for anyone who approves permission screens or builds apps. You will understand what you are really granting and which mistakes to avoid.
In this episode
Key takeaways
Worth quoting
“OAuth stands for open Authorization, and it's the standard that lets one app reach your data inside another app without ever holding your password.” – Mirko Peters (00:31)
“You might think OAuth is about signing you in, and it's actually about granting access, not proving identity.” – Mirko Peters (01:40)
Explore more on M365.FM
Follow and rate M365.FM in your podcast app, and join the free M365 community at m365con.net.
Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-microsoft-365-azure-cloud-power-platform-ai--6704921/support.
This episode includes AI-generated content.
show less
In this episode
- 00:00 – Why apps never ask for your password
- 01:56 – The four players in every OAuth handshake
- 03:31 – What happens when you click Sign in with Microsoft
- 05:28 – Why there isn't just one OAuth flow
- 07:16 – Access tokens, refresh tokens and scopes
- 08:56 – OAuth in Microsoft 365 and Azure
- 11:21 – Common mistakes and limits
Key takeaways
- OAuth 2.0 grants an app limited, temporary access through scoped tokens instead of sharing your password, but it does not prove identity.
- The authorization code flow with PKCE is the modern default for user sign-in, while the implicit flow and password grant are deprecated.
- In Microsoft 365, Microsoft Entra ID issues the tokens and Microsoft Graph accepts them, with delegated or application permissions granted by least privilege.
Worth quoting
“OAuth stands for open Authorization, and it's the standard that lets one app reach your data inside another app without ever holding your password.” – Mirko Peters (00:31)
“You might think OAuth is about signing you in, and it's actually about granting access, not proving identity.” – Mirko Peters (01:40)
Explore more on M365.FM
- Episode page: the full episode with chapters, quotes and FAQ on OAuth 2.0
- Microsoft Entra ID – the authorization server that shows the permission screen and issues tokens in Microsoft 365
- Microsoft Graph – the single doorway apps use, carrying an OAuth access token, to reach Microsoft 365 data
- Microsoft 365 – where delegated and application permissions decide what apps may read and write
- SharePoint – one of the data sources behind Microsoft Graph that an app reaches with a token
- Related episode: Microsoft Fabric for Microsoft 365 Admins: What You Need to Know
Follow and rate M365.FM in your podcast app, and join the free M365 community at m365con.net.
Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-microsoft-365-azure-cloud-power-platform-ai--6704921/support.
This episode includes AI-generated content.
Information
| Author | Mirko Peters M365, Azure & AI |
| Organization | m365 FM |
| Website | www.m365.fm |
| Tags |
Copyright 2026 - Spreaker Inc. an iHeartMedia Company
Comments