Loading

Contracts CLM: Microsoft 365 editor fails with 'configuration error or API failure' when opening contract document

Publish Date: May 26, 2026
Description

This article explains why the Microsoft 365 Word editor fails to open a contract document from Salesforce Contracts CLM and how to resolve it. Customers describe this as: "Salesforce Contract Management Microsoft 365 Editor not working", "I need help creating the Contract on Microsoft 365 - getting this error", and "a user cannot generate a document in O365 although a connection is set up". When a user clicks Create Contract in Microsoft 365 or selects Edit on a contract document version, Salesforce returns one of the following error strings verbatim: "Contract document version can't be edited. We couldn't fetch the contract document version because of a configuration error or API failure. The document can't be opened in the Microsoft 365 editor. Ask your Salesforce admin for help.", "...An External Document Storage Config with that combination of target object and record type doesn't exist.", "...Specify a valid External Document Storage Config for Contract target object.", "...The named credential selected in the External Document Storage Config is invalid.", or "...your Microsoft 365 account isn't linked to your Salesforce account." The error is triggered by one or more of the following: incomplete Microsoft Graph API permissions on the Azure app, an Auth Provider whose Default Scopes do not match the Azure permissions, a Named Credential that is not authenticated, an External Document Storage Configuration that is missing for the Contract target object and record type, an invalid SharePoint drive ID or document path, or end users who lack the View Setup and Configuration permission. The integration works for System Administrators but fails for end users when the last condition is the cause. The behaviour applies to Salesforce Contracts CLM in Enterprise, Performance, Unlimited, and Developer Editions on Summer '24 and later releases.

Resolution

Work through the causes in order. Each cause ends with a verification step.

Cause 1: Azure app API permissions or Auth Provider Default Scopes are incorrect
1. Open the Azure portal, go to App registrations and open the Microsoft app (for example, MicrosoftApp) used by Salesforce Contracts.
2. Click API permissions and confirm these Microsoft Graph delegated permissions are present: Sites.Selected, offline_access, openid, User.Read, User.ReadBasic.All. Click Grant admin consent for the tenant and confirm the status changes to Granted.
3. In Salesforce, navigate to Setup > Identity > Auth. Providers > MicrosoftApp > Edit.
4. Set Authorize Endpoint URL to https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize and Token Endpoint URL to https://login.microsoftonline.com/organizations/oauth2/v2.0/token.
5. Set User Info Endpoint URL to https://graph.microsoft.com/oidc/userinfo.
6. Set Default Scopes to exactly: Sites.Selected offline_access openid User.Read User.ReadBasic.All. The scopes must match the Azure API permissions in Step 2.
7. Clear Send client credentials in header. Select Send access token in header and Include Consumer Secret in SOAP API Responses. Save.
8. Copy the Callback URL from Salesforce Configurations and paste it into the Azure app under Authentication > Web > Redirect URIs. Save in Azure.
9. Confirm by pasting the Test-Only Initialization URL into a browser; you must be redirected back to Salesforce with a success message.

Cause 2: Named Credential is not authenticated
1. Navigate to Setup > Security > Named Credentials and open MicrosoftApp.
2. Confirm URL is https://graph.microsoft.com/v1.0, Identity Type is Named Principal, Authentication Protocol is OAuth 2.0, Authentication Provider is MicrosoftApp, Generate Authorization Header is selected, and Start Authentication Flow on Save is selected.
3. Click Edit, then Save. When prompted, sign in as the same Microsoft user that created the Azure app and the SharePoint site.
4. Confirm the Authentication Status field shows Authenticated. If it shows anything else, repeat Step 3.

Cause 3: External Document Storage Configuration is missing or invalid for the Contract target object or record type
1. In Microsoft Graph Explorer (signed in as the same integration user that authenticated the Named Credential), run GET https://graph.microsoft.com/v1.0/me/followedSites and copy the SharePoint site id.
2. Run GET https://graph.microsoft.com/v1.0/sites/<SITE ID>/drives and copy the drive id of the Documents library.
3. In Salesforce, navigate to Setup > Feature Settings > Salesforce Contracts > External Document Storage Configuration.
4. Confirm one row exists per Contract record type used in the org. If a row is missing, click New, set Target Object to Contract [Contract], Record Type to Contract Lifecycle Management (or the matching Contract record type), External Document Storage Identifier to the drive id from Step 2, Document Path to Contracts/ContractLifecycleManagement, Named Credential to MicrosoftApp, and Storage Drive Type to Microsoft OneDrive. Save.
5. Create a second row with Target Object set to Document Templates [DocumentTemplate], Record Type All, the same drive id, Document Path DocumentTemplates, Named Credential MicrosoftApp, Storage Drive Type Microsoft OneDrive. Save.
6. If the error message states "The named credential selected in the External Document Storage Config is invalid", reopen each row and reselect MicrosoftApp from the Named Credential picklist, then Save.

Cause 4: End users lack the View Setup and Configuration permission
1. Navigate to Setup > Users > Profiles and open each non-admin profile that uses Salesforce Contracts CLM.
2. Under Administrative Permissions, select View Setup and Configuration. Save. Repeat for each affected profile, or grant the permission through a permission set assigned to the affected users.

Cause 5: Microsoft 365 account is not linked to the Salesforce user
1. From the App Launcher, open Contracts and create or open a contract record.
2. Click Create Contract in Microsoft 365 > Next > Link user account > Link Account.
3. Click Go To Salesforce, then Retry, then OK. The Microsoft 365 editor must open. In Word, click Home > Add-ins and select Salesforce Contracts Connector for Word.

Confirm the issue is resolved by signing in as the affected end user, opening a contract, clicking Edit on a contract document version, and verifying that the Microsoft 365 Word editor opens the document with no "configuration error or API failure" message.

Knowledge Article Number

005385066

 
Loading
Salesforce Help | Article