Microsoft 365 Frequently Asked Questions (FAQs)

Integrate Salesforce Contracts with Microsoft 365 Azure to enable document editing and collaboration in Word. Azure provides the secure connection required for this integration. With the integration users can:

• Design and maintain contract templates by using Microsoft Word.
• Create and edit contract documents by using familiar Word features within the Microsoft 365 environment.

Yes, Salesforce Contracts works without Azure, but with limited capabilities. Without Azure integration, you can:

• Create and manage document templates in Salesforce by using Omnistudio or the Salesforce Core tools.
• Download documents for offline editing and review.
• Upload updated versions manually and maintain multiple versions in Salesforce.

Azure and Microsoft Word 365 integration is required to use these advanced features.

• Edit documents online.
• Insert Salesforce data, such as clauses, into documents.
• Perform internal and external collaborative redlining.
• Automatically reconcile and save the changes back to Salesforce.

Salesforce doesn't manage or supply Microsoft 365 or Azure licenses. Customers are responsible for setting up and maintaining their own Microsoft licensing for the integration. Customers must:

• Have a Microsoft Azure account.
• Provide an Office 365 E1 license (or later) for users who need the integration.
• Handle license setup and renewal directly with Microsoft.

To integrate Salesforce Contracts with Microsoft 365 and Azure, follow these steps.

• Configure a Microsoft Azure App.
• Configure an Auth Provider in Salesforce.
• Create a Named Credential in Salesforce.
• Create a SharePoint Site.
• Configure External Document Storage for Contracts.
• Deploy the Salesforce Contracts Connector for Word Add-in.
• (Optional) Insert the Add-in into Microsoft Word.

Yes. Salesforce provides a guided setup to help you configure Microsoft 365 and Azure integration quickly and accurately. The guided setup:

• Streamlines the configuration of the Azure App, Auth Provider, and Named Credential.
• Includes step-by-step instructions with embedded help and walkthrough videos.
• Validates your entries to reduce setup errors.
• Can be launched from Salesforce Setup by selecting Microsoft 365 and Azure Integration.

See Set Up Microsoft 365 and Azure Integration Using Guided Setup.

This is the application you register in Microsoft Azure Active Directory for the integration. It:

• Acts as Salesforce's identity within Azure.
• Salesforce to request access to Microsoft 365 resources such as SharePoint and OneDrive.
• Is identified by a Client ID and secured with a Client Secret.

The integration user authenticates with the Named Credential that connects to Azure. This user:

• Must be the person who created the Azure app
• Is used by Salesforce to generate access tokens from Azure.
• Enables the Microsoft Word Add-in to access and work with Microsoft 365 files.

You must create a dedicated Azure user with the right level of access for authenticating the Salesforce integration. The integration user:

• Must be restricted from general access—no other employees in your org should use this account.

This setup ensures secure and consistent authentication for the integration.

The Connected App (Azure AD application) requires Microsoft Graph API permissions so the Salesforce Contracts Add-in for Word works seamlessly.

To configure with admin or higher privileges, the Azure app requires write permissions:

• Files.ReadWrite.All
  • Enables the app to save and open document templates and contracts from OneDrive.
• Sites.Read.All
  • Lets the Add-in access and manage documents in SharePoint collaboration sites.
• User.ReadWrite.All
  • Lets the connected app create user extensions, which store identifiers for linking users to the correct Salesforce organization.
• Directory.Read.All
  • Provides access to directory data (such as users and groups) — used for user mapping and access control.
• openId and offline_access
  • Secures user authentication and to maintain session tokens.
• mail.send
  • Enables the Add-in to send notification emails if required.

To configure with minimum privileges, the Azure app requires only read permissions. No write access is needed:

• Sites.Selected
  • Restricts the app to access only explicitly approved SharePoint sites rather than the entire tenant. This permission can be used to replace Files.ReadWrite.All for added security. This ensures the app can write to specific sites configured via the graph explorer without granting global file permissions.
• User.ReadBasic.All
  • Grants the app permission to read a limited set of non-sensitive profile properties such as displayName, mail, photo, userPrincipalName of all users in your organization on behalf of the signed-in user.
• User.Read
  • Provides full profile access and allows reading the signed-in user’s profile (name, email, ID). Typical default scope for apps requiring user identity and portrait. Allows limited access needed for auth and personalization contexts.
• openId and offline_access
  • Secures user authentication and to maintain session tokens.

These permissions support seamless document flow between Salesforce and Microsoft 365. Users collaborate and edit documents in Word, and Salesforce remains the system of record.

The User.ReadWrite.All permission allows the app to write extensions for all users, not just the one who authenticated. The Microsoft 365 integration:

• Uses a single Microsoft account to authenticate named credentials.
• Needs this permission to write extensions for every user who opens the Add-in.
• Can't function properly with only User.ReadWrite, which limits access to the current user.

No. The Microsoft Graph API permissions are required for the Salesforce Contracts integration with Word 365 to function as designed. Key points:

• There are no workarounds to avoid the required Azure app permissions.
• The integration depends on Microsoft Graph API for secure access to OneDrive, SharePoint, and user data.
• These permissions are required to:
  • Copy files between Salesforce and OneDrive or SharePoint.
  • Modify the user extensions used for authentication.
  • Create or access SharePoint sites for storing documents.

Other options if you don't require Word 365 integration:

• Use the desktop version of Microsoft Word for offline editing.
• Consider third-party document management solutions with different integration models.

The Microsoft 365 integration extension stores linked Salesforce organization details:

• Organization's web addresses (URLs).
• Single Sign-On (SSO) web addresses used for logging in securely.
• Active Organization: Web address of your most recently accessed Salesforce org.
• First-Time User status: Tracks if you're using the Add-in for the first time.

When you open the Microsoft 365 Add-in, the integration:

• Checks whether there's stored information linking your document to a Salesforce org.
• Retrieves your stored Salesforce org details such as active and linked orgs.
• Initiates the authentication process by using these org details.
• Verifies whether the current document matches the active Salesforce org:
  • If it matches, you can continue using the Add-in.
  • If it doesn't match, you're prompted to switch to another linked Salesforce org, and the verification is repeated.

Extensions are created when you open a document in an external editor for the first time and no extension exists. The Microsoft 365 integration:

• Checks if an extension already exists.
• Communicates with the configured Microsoft Azure app to create the extension for your Microsoft account.
• Requires the Azure app to have the correct permissions to write the extension.

SharePoint is used as a centralized repository for:

• Storing contract documents and templates from Salesforce Contracts.
• Organizing files in a dedicated SharePoint site for structured access.
• Collaborating across teams with version control and shared access within Microsoft 365.

OneDrive is used for temporary file handling and online editing.

• Temporarily stores documents when a user initiates editing in Microsoft Word 365.
• Allows real-time editing of documents from Salesforce.
• Saves the changes back to Salesforce after the document is checked in.

No. Deleting a contract record in Salesforce doesn't remove the related file from OneDrive automatically. Key points:

• Files remain in OneDrive even after the contract record is deleted.
• If needed, you must remove the files manually or use automated cleanup jobs in OneDrive or Microsoft 365.

Users can work with contract documents in Microsoft Word while staying connected to Salesforce by using the Salesforce Contracts Connector for Word Add-in. With the Add-in, users can:

• Design and maintain templates directly in Word by using its formatting tools.
• Open and edit contract documents pulled from Salesforce.
• Insert Salesforce data, including clauses from the Clause Library.
• Save the changes back to Salesforce.
• Use Contracts AI to draft clauses in Word.

Files are automatically moved from Salesforce to OneDrive or SharePoint after you set up the Microsoft Azure connection. The Add-in isn't required for this step. However, the Add-in is required to:

• Pull data from Salesforce into the document.
• Create sections inside the document.
• Add and track internal and external reviews.
• Reconcile the document and push the final version back to Salesforce.

Salesforce administrators deploy the Salesforce Contracts Connector for Word Add-in centrally through the Microsoft 365 admin center. Deployment steps:

• Upload the Add-in manifest file provided by Salesforce to the Microsoft 365 admin center.
• Assign the Add-in to all users or specific groups as needed.

After the Microsoft Add-in is deployed, users can:

• Open Microsoft Word 365.
• Click More Options, and then select Salesforce Contracts Connector for Word.

Salesforce doesn't publish a fixed schedule for updates to the Salesforce Contracts Connector for Word Add-in. Here's what to expect.

• Major updates often align with Salesforce's seasonal release cycles (Spring, Summer, Winter).
• Minor patches or fixes are often released more frequently, depending on need.

Release announcements are typically shared through:

• Salesforce release notes.
• Microsoft AppSource listing for the Add-in.

For the latest version and update details, regularly check these sources.