- How do I install dcblogdev/laravel-microsoft-graph in a Laravel app?
- Install it with Composer using composer require dcblogdev/laravel-microsoft-graph, then publish the package config with php artisan vendor:publish. Add your Azure tenant ID, client ID, and client secret to your .env file and expose a callback route for the OAuth redirect. A working delegated flow is usually achievable in under a day.
- Which Laravel and PHP versions does laravel-microsoft-graph v4 support?
- The v4 line is the supported line and v4.0.9 explicitly adds Laravel 13.x compatibility, so the package tracks current framework releases rather than lagging behind. You should still confirm the package's Laravel and PHP constraints against your own composer.lock before merging. Pin the exact version in composer.json to avoid surprise upgrades.
- How does OAuth authentication work with this Laravel package?
- The package owns the OAuth2 authorize and callback flow against your Azure AD app registration, so you redirect the user to Microsoft, receive the callback, and the package exchanges the code for tokens. It then handles token persistence and refresh so you do not have to write that logic yourself. Callers still work in terms of Microsoft Graph resources and permission scopes, since this is a convenience layer rather than an abstraction layer.
- Do I need an Azure AD app registration to use laravel-microsoft-graph?
- Yes. You must register an application in Azure AD, configure the redirect URI, and grant the Graph permission scopes your app needs. Admin consent is required for many scopes and must be granted per tenant, so validate against a non-production tenant first because consent behavior differs between tenants. Store the client secret securely and plan for rotation before it expires.
- What is the difference between delegated and application permissions in Microsoft Graph?
- Delegated permissions act on behalf of a signed-in user and go through the interactive OAuth flow, while application permissions run as a daemon with no user present. Decide which model you need, or whether you need both, before you design your token storage and job queueing. The package supports both patterns, but your consent and secret-rotation strategy differs significantly between them.
- How are access tokens stored and refreshed by this package?
- The package persists tokens and refreshes them automatically, using a database table or cache depending on your configuration. You still need to think about where that storage lives, how it is protected, and what happens if a refresh token is revoked. Rotating the Azure client secret is your responsibility, so plan the blast radius for when it expires.
- Is upgrading from v3 to v4 of laravel-microsoft-graph a breaking change?
- Yes, v3 to v4 is a major-version boundary and should be scoped as its own work item with a dedicated test pass. Even within v4.0.x, v4.0.9 contains a patch-level user type refactor from User/TestUser to Authenticatable and a rename of $folderId to $folderIdOrName, which breaks callers using PHP named arguments. Pin the exact version, grep for named arguments and old user type references, and exercise any test doubles that touched TestUser before deploying.
- How do I handle Microsoft Graph throttling (HTTP 429) with this package?
- The package does not remove the need for your own backoff and queueing design. Microsoft Graph enforces per-tenant throttling and returns 429 responses with a Retry-After header, which you should honor. Push bulk or batch operations onto queued jobs with retry logic so a throttled request does not fail a user-facing flow.
- How do I test a Laravel Microsoft Graph integration without hitting the real API?
- Mock the package's facade or underlying HTTP client so tests never reach login.microsoftonline.com or graph.microsoft.com. Note that v4.0.9 changed the test fake user type to Authenticatable, so any existing test doubles referencing TestUser need updating. Also run a smoke test in a staging Azure tenant, because a green CI run cannot validate per-tenant consent and conditional-access behavior.
- What are the alternatives to dcblogdev/laravel-microsoft-graph?
- The main alternative is Microsoft's official msgraph-sdk-php, which is more verbose but gives you the full Graph surface and is maintained directly by Microsoft. Laravel Socialite only covers the login portion and will not give you mail, calendar, or file access on its own. This package's value is removing the OAuth authorize, callback, and token refresh work from your codebase, so weigh that against the tighter control an SDK gives you.