O365 --> MS365 - A potential big change - your views needed

[RogerSelwyn]

👋 Your views needed!

I'm using Discussions as a place to connect with other members of the community and understand your point of view on a potential major change.

I've noted in the release notes to v4.8.0 that the integration is becoming unwieldy. It has grown under my stewardship from an integration that supported calendars and email, to one that supports a whole variety of different sensors. This makes it slow to start up and operate and along with being a massive chunk of code to maintain.

I've started down a road that to breaking this up into smaller components, probably along the lines of Calendar, Email and Teams. To that end I have created a new integration just for calendars. I've branded this as MS365 inline with Microsoft's changed branding of Office 365 to Microsoft 365. This has the benefit of clearly separating the integrations.

I'm very conscious that there is a significant following of this integration, so this may be an unpopular change, but I feel it is necessary. Other may suggest doing it another way, and I'm certainly open to views. My knowledge of what can be done with Python and HA is a long way of perfect, I'm an enthusiastic amateur.

I've taken to decision to make in the installation of the integration as being UI only. The calendars.yaml file still exists and the calendars can be managed via that method, but there is the ability to modify most of the config via the UI.

Again, this may be an unpopular decision because many want to be yaml only. I have previously managed an integration that does both YAML and UI, but it is a pain, so I'm not doing it again. I think with recent advances in the HA UI around reconfigure and reload, this will remove the need to go delete tokens or reboot HA.

Anyway, I'm open to comments. For reference the new calendar is here MS365-Calendar. I would warn that it needs HA 2024.6.x since it incorporates changes included with that release.

[B-Hartley]

I only really use to-do
Where will that sit?

I have no strong feelings either way.

If it's easier for you to break it up. That's good enough for me.

[topgun0dk]

Same i do

[RogerSelwyn]

I have already created the new ToDo integration.

[topgun0dk]

I saw that further down. And it is now installed :)
Thanks a lot for your work

[RogerSelwyn]

Probably in Teams, but I may make that a fourth Integration. It’s quite complex like calendar.

[lexiismadd]

I think separated is a good idea, easier to manage, easier to diagnose issues.
Teams is definitely one area I use

[RogerSelwyn]

The dedicated Teams integration is available, there is a link in this thread further down

[SamBouwer]

@RogerSelwyn thank you for the open communication! I would fully support the split into separate integrations like you did for Calendar. It might be a (bit of a) pain for users, but I can see it benefits the maintenance of the integrations.

[uSlackr]

@RogerSelwyn I've been using this since you took it over and appreciate the long-term effort and commitment you've made to this project. I like the idea of breaking up the code to reduce the load on the system and the less code the fewer bugs affect any particular install. Are you concerned you could wind up making the same changes 3-4 times?
FWIW I use calendar and to-do.

[RogerSelwyn]

I am concerned about duplication in the initial, config_flow, permissions logic. I might break it out into generic/specific code blocks, so I can copy content between integrations. I'll figure that as I get into the second one. I may break ToDo into a fourth module since it is similar to calendar in concept.

[RogerSelwyn]

As a passing comment, I haven't taken advantage of HA application credentials, because in general that seems to assume it will request, hold and manage the token, and the python-o365 simply isn't structured to work like that.

[loryanstrant]

I do think it's logical to break it up, as realistically there are different use cases across the M365 stack, plus it allows more people to contribute to certain areas of passion (and hopefully for those who have created other "competing" components to pool their efforts into these ones).
While I know practically nothing of Python, I do work with M365 and Graph daily (it's literally my job to help orgs out with this stuff and build custom solutions on it), so if you like I'm happy to get more involved across all the various components (whether it's architecture, integration in M365, functionality, testing, documentation, etc.).

[RogerSelwyn]

Thank you very much for your offer, much appreciated. I'll do the split up, and try to document what it is doing as best I can in some form (given it goes via a 3rd party library). Then maybe you can have a look and see if there are better ways of doing what it does.

[smarthomefamilyverrips]

First of all thank you for the work you put in to this. To me it seems a good choice as looking at other comments here more people just use a part of the functionality of the O365 integration same as I do. I only need/use it for getting Calendar data of my Outlook Calendar from work, so I personally I prefer a less heavy integration giving me just what I need. So definitely a +1 from me on this.

I surely will try out the M365-Calendar integration.

[RogerSelwyn]

For those interested, I have started writing up some documentation on what calls are made as part of the main retrieval cycle - https://github.com/RogerSelwyn/O365-HomeAssistant/wiki

I need to think about repository structure, to see if I can store all the integrations in one repository rather than multiple. This will depend on what HACS supports.

[RogerSelwyn]

I need to think about repository structure, to see if I can store all the integrations in one repository rather than multiple. This will depend on what HACS supports.

Well that question is answered:

- There must only be one integration per repository, i.e. there can only be one subdirectory to ROOT_OF_THE_REPO/custom_components/. If there are more than one, only the first one will be managed.
- All files required for the integration to run must be located inside the directory ROOT_OF_THE_REPO/custom_components/INTEGRATION_NAME/.

[RogerSelwyn]

I've just released a first version of the MS365-ToDo integration. Again needs 2024.6.x

[B-Hartley]

It says I need 2024.6.0 to install it, but that version isn't out yet.
I'm on 2024.6.0b4

[B-Hartley]

I've installed manually for now, I'll let you know how it goes.

[RogerSelwyn]

I would have thought it would allow that. You can always manually copy it. Otherwise wait until Monday

[B-Hartley]

Installed manually, configured through UI. All seemed to go ok and my lists are showing. No time to test more right now, but looks ok ! Thanks

[RogerSelwyn]

I've just released a first version of the MS365-Mail integration. Again needs 2024.6.x

Teams is still to come, but won't get done until mid-July. I've also requested HACS inclusion for the three already done, but that will take some months to get included.

[RogerSelwyn]

I've just release a first version of MS365-Teams. I will submit a HACS inclusion request as soon as the brand icon has been accepted into HA Core.

Expect HACS to take many months, it is very, very slow.

[RogerSelwyn]

Just to update. HACS seems to have stopped accepting new integrations at the moment. I suspect this is because a new version is being developed which is currently in Alpha (or was when I looked a week ago). Hopefully when it is released they will work through the backlog.

I will endeavour to maintain both the O365 integration, and the split up versions until they make it onto HACS proper. I will then do some "marketing" on the new ones to encourage the move so I can decommission the old. This of course may take some time.

[tastyllama]

Thanks for the updates! Appreciate all your hard work.

[cromulus]

Amazing work. Thank you!!! IMHO, this should be HA core.

[RogerSelwyn]

I do have a P1 license so if you need me to test something let me know. I also have a tenant with a windows premium account which includes a P2 license.

I think when I wrote this I was pissed off at MS. I setup and pay for a P1 license (£5.68/month), to be honest I have no idea whether I need it or not. I thought I had setup MFA, but it never asks me for it when I log into Entra, probably because I'm using full admin (yep I know I shouldn't, but when I get charged for each MS365 account and I only have 3, I don't need the uplift).

It nags me when I log into Entra saying that MFA is needed, and in line with MS standard the documentation leads you through several pages with no clarity on what is needed. I imagine you guys can confirm whether I need it.

[RogerSelwyn]

Also if you love the branding of MS365 and Entra be aware that Microsoft is in the process of changing all their branding to copilot even i you don't have a copilot license lol. Because of course they are.

I recently change the branding on the integrations and was aware of the Copilot change. These integration are unlikely to ever do anything Copilot, so whilst I'll try to follow branding I wouldn't plan to change to anything that implies any level of intelligence.

[RogerSelwyn]

Yeah, I don't acknowledge that as a thing because it's universally accepted as stupid and confusing - even by many of the MS folks I work with.

There's about 1,000 MVPs (including myself) rolling into Redmond late March - you can bet we'll be carrying pitchforks on that topic. :-)

They seem to have dumped Copilot onto everything. I'm getting too old I think, I can be doing with VS Code trying to shove it down my throat and I just tuned my MS365 Office Apps down to Family Classic because I don't want to pay £25 extra for something I will be very unlikely to ever use.

[loryanstrant]

Also if you love the branding of MS365 and Entra be aware that Microsoft is in the process of changing all their branding to copilot even i you don't have a copilot license lol. Because of course they are.

I recently change the branding on the integrations and was aware of the CoPlilot change. These integration are unlikely to ever do anything CoPilot, so whilst I'll try to follow branding I wouldn't plan to change to anything that implies any level of intelligence.

https://www.letmecorrectthatforyou.com/#copilot

[RogerSelwyn]

https://www.letmecorrectthatforyou.com/#copilot

I stand corrected. It's still nonsense.

[dreamworks]

I would love to chat/discuss with you about the O365 ./. M365 challenge.
(done more than 15 years of SharePoint O365/C#/REST development)

[RogerSelwyn]

Happy to have a chat some time. Give me a ping on firstname @ surname org uk

[pantherale0]

Hi @RogerSelwyn - some great work here and I use mainly the Teams side of things, but have an awful lot of experience with Graph API itself.

As we're using OAuth flows, shouldn't the integrations use Application Credentials in HA as documented here? https://developers.home-assistant.io/docs/core/platform/application_credentials/

As a side note - breaking this down will help me contribute to areas I use the most (Teams), so will probably start sending some PRs soon for new functionality.

[RogerSelwyn]

I’ve looked at using the HA app credentials mechanism, but really the library the integrations use (python-o365) isn’t set up to work with the ha mechanism. HA wants to do the oauth calls itself, whilst the library is designed to handle it all itself.

[RogerSelwyn]

Any prs would be appreciated, just give me an idea what you plan before you submit something please.

[fenty17]

@RogerSelwyn - can you advise on the best way to upgrade from O365 to MS365 Calendar. Can we install side by side or save any config, or is it set the new one up from scratch?

[RogerSelwyn]

You can install side by side. If you have done config in calendars.yaml (or todos/tasks.yaml) then you will be able to copy that content across to MS365 after you install the new integration. After you have disabled O365, you could then rename any entities to match the old ones, avoiding having to update automations/etc.

I'm not sure it would be easy for me to automate it, because one is in yaml and the other is via UI (which will avoid the endless mis-config issues I get), but I'll chew on it before we get into any forced migration in the middle of next year.

[RogerSelwyn]

Just to add, I'm working through create an o365 service that will create the config entries for the relevant MS365 integrations. All you will need to do is click on the integration option to re-configure and then re-authenticate to MS.

[leedrake]

Roger,

This is a duplicate of the post on the HASS Forums, so feel free to respond in either - I'll get notified.

thank you so much for your hard work on this module.

I got the original o365 working and that seemed to be relatively easy (I’m pretty familiar with graph and application permissions in Entra). I noticed you were moving to separate installs using the new configuration and one per function. I think that’s great, and downloaded and installed the MS365 - Calendar module and got THAT working as well, and removed the yaml entries for the o365 module and am using just the new one.

A couple of possible edits for your documentation. When searching in HACS for the repository, since it’s not in the main one and you need to use custom the steps are:

Search for rogerselwyn/MS365-Calendar to find the repository when using custom. Without your name at the beginning it can’t find it.
Download the repository
Once the repository is downloaded into HACS you need to find it and choose install. I am not super familiar with HACS so this step wasn’t clear to me, but I eventually figured it out. I suppose I should have read the HACS documentation more thoroughly - this isn’t on you lol.
I installed and got it up and running with alt-login, I was having issues getting the regular one to work on o365 module and the alt worked fine, so I just switched to that and continued using it for the ms365 module.

I have just a couple questions:

If I am loading the calendar for more than one user into HASS do I just add it as a second integration with a different email account name? Or is there a method to add an additional user using the existing entry? If I am adding it again do I do that from HACS or from the HASS integration page?
If I am doing a second user, since it’s delegated permissions, can I just use the same AppId and secret but a different email? Or do I need to add a different secret? Or a new separate application entry altogether?
Sorry if these are dumb questions - just trying to get clarity. I’m totally behind your new efforts and it’s awesome that I can actually write back calendar, todo, etc. updates from HASS. Graph is so cool. I have VOIP phones and freepbx all over the house in an intercom system, so being able to send TTS Voice announcements to them when events are upcoming will be way cool :slight_smile:

Oh and just one more note - if you have entraID P1 or 2 and have the ability to configure conditional access it’s a REALLY good idea to set a policy that only lets the public IP address of your home server access the app you configure in Entra, and limit access to only accounts that you want to retrieve calendars for. If you have a fixed IP you can use that address as the allowed location, and block all other locations. This severely limits the ability for anything else to access it - even if they somehow got your app id and secret.

If you’d like to add a documentation section on doing that, I’d be happy to write it. Let me know.

[pantherale0]

You can check your licensed features here:
https://portal.azure.com/#view/Microsoft_AAD_IAM/LicensesMenuBlade/~/LicensedFeaturesState

For phone & sms based MFA, you need a O365/P1/P2 license for example. I've actually just looked over my own licenses and I have business standard, not premium

[pantherale0]

Ahh I've just seen, conditional access is only available under P1/P2. Although it seems you can set it up with a trial license and the config will still continue to apply long after that trial has ended.

[RogerSelwyn]

Yep, but it costs, not a lot, but it provides me very little. If I change back to per-user, I can remove the conditional. At the moment it is set with no MFA on my admin account which is shocking practice (but how the walkthrough sets it up). I just need to fix it when I'm bored enough.

[leedrake]

Yeah Microsoft raised the price of P1 ridiculously. If it were a buck a month or something fine, but at it's current price most won't bother to buy it. It's really just a layer of security everyone should have access to. I hate their policy of "The cheaper it is the less secure it is". If we just started with full security features and differentiated based on actual user features it would reduce so much hacking and compromise issues. Sorry to introduce this and the above discussion certainly illustrates why it might become a support headache. I withdraw my suggestion. 👍

[RogerSelwyn]

So I've just gone through and added MFA to my account, and will swap everyone to having MFA enabled/enforced. Some re-login will be required.

Good news, it's identified an exception in the code I need to handle better.

[leedrake]

yeah mfa is essential these days. I try to avoid creating accounts on services or sites that don't offer it. Plus Microsoft has already made it mandatory for admin, and will probably make it mandatory for all soon. Might as well get the pain out of the way now. ----------------------------------- Lee Drake ***@***.***

…

On Wed, Feb 5, 2025 at 12:24 PM RogerSelwyn ***@***.***> wrote: So I've just gone through and added MFA to my account, and will swap everyone to having MFA enabled/enforced. Some re-login will be required. Good news, it's identified an exception in the code I need to handle better. — Reply to this email directly, view it on GitHub <#234 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABQ3HFKKYQQGRHAVFR6H7CL2OJCM5AVCNFSM6AAAAABISWZCIOVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTEMBXGI2DSOI> . You are receiving this because you commented.Message ID: <RogerSelwyn/O365-HomeAssistant/repo-discussions/234/comments/12072499@ github.com>

[RogerSelwyn]

That's the thing, it wasn't switched on for my admin, so it wasn't mandatory. It is enabled for my admin account now.

[pantherale0]

Very unlikely to see Microsoft force MFA for all users. That would be a complete headache for a lot of 1st line support you would then have to explain to every person that by installing the authenticator app or receiving a text message on your phone IT isn't spying on your personal life.

The only time MFA has been enforced on my admin accounts (both in work and outside of work) has been via conditional access policies.

[RogerSelwyn]

I think I agree on whether they will enforce or not. That said, with so few users, I'm just enabling per-user MFA on all accounts.

[Alexius30]

Hey,
I'm having a problem with authorization. I've followed all the steps in the documentation and everything has worked great so far. However, when linking to my MS account, there are problems with the URL that needs to be entered.
Error: It loads for several minutes until the message "Unknown error occurred" appears.
Does anyone have a solution for this?

[RogerSelwyn]

Please create a bug report with the requested information, including info from the system log.

[RogerSelwyn]

For those following this, you may have noticed that MS365 - Calendar, Mail and To Do have been added to HACS default recently, with Teams expected in a few weeks. Consequently I will be shutting down development on the O365 integration, apart from HA core mandated changes until 2025.11 when I believe the integration will fail (see the note on the Read Me).

I will add deprecation notices to the integration.

[RogerSelwyn]

Teams is now available on HACS default. Consequently there will be no new development work on O365.

[uSlackr]

I migrated last week with no issues. Thanks for your continued work on this! \\Greg

…

________________________________ From: RogerSelwyn ***@***.***> Sent: Tuesday, March 4, 2025 02:50 To: RogerSelwyn/O365-HomeAssistant ***@***.***> Cc: uSlackr ***@***.***>; Comment ***@***.***> Subject: Re: [RogerSelwyn/O365-HomeAssistant] O365 --> MS365 - A potential big change - your views needed (Discussion #234) Teams is now available on HACS default. Consequently there will be no new development work on O365. — Reply to this email directly, view it on GitHub<#234 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AGEO6Z6MK3Y465YMXAEWQGT2SVLNDAVCNFSM6AAAAABISWZCIOVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTEMZYGUYDANY>. You are receiving this because you commented.Message ID: ***@***.***>