enterprise-integration

Enterprise Integration Skill

Expert in building enterprise features with Microsoft Graph API, Microsoft Entra ID authentication, and enterprise-mode feature gating for VS Code extensions.

⚠️ Staleness Warning

Microsoft Graph and Microsoft Entra ID APIs evolve frequently. Authentication flows and permission models change. See EXTERNAL-API-REGISTRY.md for source URLs and recheck cadence.

Refresh triggers:

• Microsoft Graph API version updates
• MSAL library major releases
• Microsoft Entra ID rebranded to Microsoft Entra ID
• New Graph scopes or permissions

Last validated: February 2026 (MSAL 2.x, Graph v1.0)

Check current state: Microsoft Graph docs, MSAL.js docs

---

Microsoft Graph Integration Pattern

Authentication Flow

// Progressive scope acquisition - request minimal scopes initially
const INITIAL_SCOPES = ['User.Read'];
const GRAPH_SCOPES = [
    'User.Read',
    'Calendars.Read',
    'Mail.Read',
    'Presence.Read',
    'People.Read'
];

// Get token with automatic scope upgrade
async function getGraphToken(): Promise<string | null> {
    const session = await vscode.authentication.getSession(
        'microsoft',
        GRAPH_SCOPES,
        { createIfNone: false }
    );
    return session?.accessToken ?? null;
}

// Check availability without triggering auth prompt
function isGraphAvailable(): boolean {
    return !!cachedToken && isEnterpriseMode();
}

API Client Pattern

const GRAPH_ENDPOINT = 'https://graph.microsoft.com/v1.0';

async function graphFetch<T>(path: string): Promise<T | null> {
    const token = await getGraphToken();
    if (!token) return null;
    
    const response = await fetch(`${GRAPH_ENDPOINT}${path}`, {
        headers: { 'Authorization': `Bearer ${token}` }
    });
    
    if (!response.ok) {
        console.error(`Graph API error: ${response.status}`);
        return null;
    }
    
    return response.json();
}