This tool uses the standard OAuth 2.0 authorization code flow (Device code authentication) to authenticate users with Office 365. When user sign-in, the app redirects the user to Microsoft Sign-in page (https://microsoft.com/devicelogin), once the user completed the sign-in process, the app gets access token and use it for further communication between the app and Microsoft Teams, Planner, OneDrive, Stream and Viva Engage(Yammer).

After OAuth 2.0 authorization, the app will receive the access and a fresh token. The received tokens are stored in the SQLite DB. The DB is present in the machine where the app is installed. The lifetime of the access token varies between 60 to 90 minutes, and it is assigned during the generation process itself by Azure AD. Every time before using the access token, the app checks for the expiry time. In case, it is going to expire in next 5 minutes, using refresh token, a new access token is generated.