What's included
- Entra ID (Azure AD) sync, import employees and keep them in sync automatically
- Microsoft Teams notifications, approval requests and confirmations as Teams messages
- Outlook calendar sync, approved leave appears as all-day events in Outlook
- Single Sign-On (SSO), employees sign in with their Microsoft account
- Out-of-Office replies, TimeLeaf can automatically set OOO messages in Outlook
Setup
You need Microsoft 365 Global Administrator or Application Administrator access to complete this setup.
Register an app in Azure
Go to the Azure Portal → Microsoft Entra ID → App registrations → New registration.
- Name:
TimeLeaf - Supported account types:
Accounts in this organizational directory only - Redirect URI:
https://[your-slug].timeleaf.io/auth/microsoft/callback
Grant API permissions
In your app registration → API permissions → Add a permission → Microsoft Graph. Add the following Application permissions:
User.Read.All, sync employee directoryCalendars.ReadWrite, write approved leave to OutlookMailboxSettings.ReadWrite, set OOO messages (optional)ChannelMessage.Send, send Teams notifications (optional)
Click Grant admin consent for your organisation.
Copy credentials to TimeLeaf
In the Azure portal, go to your app → Certificates & secrets → New client secret. Copy the value immediately (it's only shown once).
In TimeLeaf, go to Settings → Integrations → Microsoft 365 and enter:
- Tenant ID (from the Overview page)
- Client ID (Application ID)
- Client Secret
Run the initial sync
Click Sync now. TimeLeaf will import all active users from Entra ID. Subsequent syncs run every 6 hours automatically.
You can map Entra ID fields (Department, Manager) to TimeLeaf's organisation structure during the first sync.
Teams notifications
Once the integration is connected, go to Settings → Notifications → Microsoft Teams. Employees will receive a Teams message when:
- Their leave request is approved or declined
- They have a pending request that needs attention
- A team member's leave is approved (visible on their team feed)
Troubleshooting
| Problem | Solution |
|---|---|
| Sync shows 0 users | Check that User.Read.All permission has admin consent granted. Also verify the Tenant ID is correct. |
| Calendar events not appearing | Confirm the Calendars.ReadWrite permission is granted and the user's mailbox is an Exchange Online mailbox (not on-premises). |
| SSO login fails | Check the Redirect URI in Azure exactly matches the one in TimeLeaf settings (including https:// and trailing path). |