Support for Microsoft Graph API Delegated Permissions in Pega Sales Automation OOTB

General
,
1

Hi Everyone,

I am currently working on integrating Microsoft Graph API with Pega Sales Automation (version 25.1.2) and would like to clarify the Out-of-the-Box (OOTB) support for different permission types.

Current Behavior:

  1. Delegated Permissions: When we configure the Graph Authentication Profile with Delegated Permissions, we are unable to call the Graph APIs integrated within Sales Automation. We consistently receive a “Missing Permission Access” error, even though the permissions are granted on the Azure side.

  2. Application Permissions: When using Application Permissions, the integration works as expected, and we can successfully execute the API calls.

Reference followed: Updating the Graph authentication profile

Questions:

  1. Does Pega Sales Automation currently support Delegated Permissions OOTB for its standard Graph integrations, or is the OOTB functionality restricted to Application-level permissions only?

  2. If Delegated Permissions are not supported OOTB, what is the recommended approach?

    • Should we build a custom wrapper API to handle the OAuth2.0 Authorization Code flow?

    • If a wrapper is built, what is the best practice for plugging this into the existing Sales Automation framework to ensure features like calendar/email sync continue to function?

Any guidance or documentation on handling user-level delegated context within Sales Automation would be greatly appreciated.

Thank you!

2

Pega Sales Automation OOTB Graph integration is designed to work with application permissions, not delegated permissions, which is why you see the missing permission error. The clear solution is to implement a custom OAuth 2.0 Authorization Code flow wrapper that handles delegated tokens externally and then pass the access token into Pega through a custom authentication profile or REST connector. This wrapper should manage user consent, token refresh, and scope handling outside Pega. Inside Pega, update the existing Graph connectors to use this token dynamically instead of the default profile. This keeps your integration aligned with user-level access while still allowing features like email and calendar sync to function correctly.