Microsoft Project (Planner)
Create Microsoft Planner tasks from Safeguard. The Microsoft Entra app and Graph permissions Safeguard needs, and step-by-step setup.
Availability
This integration is switched on per workspace. If you do not see the card under Integrations, ask your Safeguard contact.
What it does
The Microsoft Project card creates tasks in a Microsoft Planner plan through Microsoft Graph, for the findings and work you send to it, and adds notes to a task's description as it changes. Microsoft Project for the web is not written to directly: Safeguard writes Planner tasks in the plan (and optional bucket) you choose. Find the card under Integrations on the Notification tab.
Public vs private
This does not apply to Microsoft Planner: you always connect a plan in your own Microsoft 365 tenant with an app registration.
Supported auth methods
| Method | Use it when | Notes |
|---|---|---|
| Microsoft Entra app with a client secret (application permissions) | All connections | The dialog asks for Directory (tenant) ID, Application (client) ID and Client Secret |
| Signing in as a user (delegated) | Not available yet | |
| Certificate credentials | Not available yet | The dialog takes a client secret |
Permissions required
Safeguard reads the plan and creates and updates tasks in it. It never deletes tasks or plans.
Microsoft Graph application permissions (admin consent required)
| Permission | Required? | What Safeguard uses it for |
|---|---|---|
Tasks.ReadWrite.All (application) | Required | Reading the plan (GET /planner/plans/{id}), creating tasks (POST /planner/tasks), and updating task details (PATCH /planner/tasks/{id}/details) |
Organization.Read.All (application) | Optional | Showing your tenant's name after the check (GET /organization). Without it the check still passes |
Tasks.ReadWrite.All as an application permission reaches every plan in the tenant; Microsoft lists no narrower application permission for creating Planner tasks.
Least privilege: a dedicated app registration with Tasks.ReadWrite.All only, and a short-lived client secret.
Token types
| Credential | Works? | Notes |
|---|---|---|
| Client secret of an app registration | Yes | Paste the secret's Value, not its ID |
| Certificate | Not available yet | |
Delegated permissions (Tasks.ReadWrite) | No | Safeguard uses the client credentials flow, which needs application permissions |
| Managed identity | No | Safeguard runs outside your tenant |
Expiry: client secrets expire on the date you choose when you create them. Create a new one before then; after it expires, task creation stops until you paste a new secret.
What we never need: Group.ReadWrite.All, Directory.ReadWrite.All, Sites.*, Mail.* or any delegated permission.
Step-by-step setup
Create the credential in Microsoft Entra ID
- In the Microsoft Entra admin center, go to App registrations and create a new registration (single tenant).
- Copy the Application (client) ID and Directory (tenant) ID from its overview.
- Under API permissions, add Microsoft Graph application permission
Tasks.ReadWrite.All(andOrganization.Read.Allif you like), then grant admin consent. - Under Certificates & secrets, create a client secret and copy its value. It is shown only once.
- Find the plan's ID (and a bucket's ID, if you want tasks in one bucket), for example with Microsoft Graph:
GET /groups/{group-id}/planner/plansandGET /planner/plans/{plan-id}/buckets.
Or with the Azure CLI
az ad app create --display-name safeguard-planner --sign-in-audience AzureADMyOrg
az ad sp create --id <application-id>
# Add Microsoft Graph > Application permissions > Tasks.ReadWrite.All in the portal, then:
az ad app permission admin-consent --id <application-id>
az ad app credential reset --id <application-id> --display-name safeguard --years 1Connect it in Safeguard
- Open Integrations and choose the Notification tab.
- Click Connect on the Microsoft Project card.
- On Credentials, enter an Integration Name and an optional Description, then the Directory (tenant) ID, Application (client) ID, Client Secret, Plan ID and, optionally, Bucket ID.
- Click Next. "Credentials are validated on save. Tasks will be created in plan ..." is shown.
- Click Connect. Safeguard requests a token and reads the plan before it saves.
Webhooks and triggers
The dialog does not set up Microsoft Graph change notifications yet, so changes made in Planner are not sent back to Safeguard. Safeguard creates tasks and updates their details when the events you route to Planner happen.
What we read and store
- Read: the plan's title and, with
Organization.Read.All, your tenant's name. - Stored: the connection's name, tenant ID, application ID, plan and bucket, links between Safeguard items and Planner tasks, and the client secret. Safeguard never shows the secret again in the dialog.
- Sent to Microsoft Planner: task titles and descriptions about your Safeguard findings.
- No customer data from this integration is sent to third-party LLMs.
Troubleshooting
| Message you see | Cause | Fix |
|---|---|---|
Azure AD token request failed: ... | The tenant ID, application ID or secret is wrong, or the secret expired | Copy the IDs from the app's overview and create a new secret |
Planner plan lookup failed: ... | The plan ID is wrong, or the app lacks Tasks.ReadWrite.All with admin consent | Check the plan ID and grant admin consent |
Failed to save configuration | The connection could not be saved | Check the fields and try again |
Rotation and disconnect
- Rotate: create a new client secret, open the connection on the Notification tab, choose Update, paste the new secret and choose Save Changes. Then delete the old secret under Certificates & secrets.
- Disconnect: choose Delete on the connection, then delete the client secret or the whole app registration. Tasks already created stay in Planner.
Vendor references
- Create plannerTask (Microsoft Graph), checked 2026-10-16.
- Get plannerPlan (Microsoft Graph), checked 2026-10-16.
- Update plannerTaskDetails (Microsoft Graph), checked 2026-10-16.
- Get organization (Microsoft Graph), checked 2026-10-16.