High-level Overview

On click of the button/Endpoints:

1. Retrieve static content from Azure CDN.
2. SSO process – gets auth token if required.
3. Graph API gets the graph token using the auth token.
4. Phish Reporting API is used for pulling back company settings based on the logged-in user.
5. Mail is sent as the user to the Phish Reporting API using the Graph API/Token. 

Web Application

Breakdown of the manifest:

• App domain section must contain all domains used in the SSO process; otherwise, the user will be redirected to their browser.
• Code is stored on our servers, with access being via the CDN (under the Desktop Settings section).
• You may need to include app security domain to AppDomains.

• Permissions we ask for via Graph-API: