Add Microsoft 365 SCIM bridge and access review driver

Microsoft 365's native SCIM endpoint is unreliable, so mirror the
Google Workspace bridge over Microsoft Graph: a new MICROSOFT_365
OAuth2 connector, a SCIM bridge provider listing /v1.0/users with
$select pagination, and an access review driver that derives admin
status from /directoryRoles members. Refactor the bridge runner to
share OAuth2 plumbing across providers and surface the new bridge
type, scopes, UI card, and bootstrap env wiring.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/bootstrap/builder.go

@@ -336,6 +336,17 @@ func (b *Builder) Build() (*probodconfig.FullConfig, error) {
 		})
 	}
 
+	if microsoft365ClientID := b.getEnv("CONNECTOR_MICROSOFT_365_CLIENT_ID"); microsoft365ClientID != "" {
+		cfg.Probod.Connectors = append(cfg.Probod.Connectors, probodconfig.ConnectorConfig{
+			Provider: "MICROSOFT_365",
+			Protocol: "oauth2",
+			RawConfig: probodconfig.ConnectorConfigOAuth2{
+				ClientID:     microsoft365ClientID,
+				ClientSecret: b.getEnv("CONNECTOR_MICROSOFT_365_CLIENT_SECRET"),
+			},
+		})
+	}
+
 	return cfg, nil
 }
 
@@ -382,6 +393,7 @@ func (b *Builder) validateRequired() error {
 		{"CONNECTOR_INTERCOM", []string{"CLIENT_SECRET"}},
 		{"CONNECTOR_BREX", []string{"CLIENT_SECRET"}},
 		{"CONNECTOR_GOOGLE_WORKSPACE", []string{"CLIENT_SECRET"}},
+		{"CONNECTOR_MICROSOFT_365", []string{"CLIENT_SECRET"}},
 	}
 
 	for _, p := range oauthProviders {

pkg/bootstrap/builder_test.go

@@ -95,6 +95,16 @@ func TestBuilder_Build_MissingRequiredEnvVars(t *testing.T) {
 			},
 			wantMissing: []string{"CONNECTOR_GOOGLE_WORKSPACE_CLIENT_SECRET"},
 		},
+		{
+			name: "microsoft 365 connector missing required fields",
+			env: map[string]string{
+				"PROBOD_ENCRYPTION_KEY":             "key",
+				"AUTH_COOKIE_SECRET":                "secret",
+				"AUTH_PASSWORD_PEPPER":              "pepper",
+				"CONNECTOR_MICROSOFT_365_CLIENT_ID": "client-id",
+			},
+			wantMissing: []string{"CONNECTOR_MICROSOFT_365_CLIENT_SECRET"},
+		},
 	}
 
 	for _, tt := range tests {
@@ -398,6 +408,27 @@ func TestBuilder_Build_GoogleWorkspaceConnector(t *testing.T) {
 	assert.Equal(t, "gw-client-secret", rawConfig.ClientSecret)
 }
 
+func TestBuilder_Build_Microsoft365Connector(t *testing.T) {
+	env := requiredEnv()
+	env["CONNECTOR_MICROSOFT_365_CLIENT_ID"] = "ms365-client-id"
+	env["CONNECTOR_MICROSOFT_365_CLIENT_SECRET"] = "ms365-client-secret"
+
+	b := NewBuilder(mockEnv(env))
+	b.samlCertificate = "test-cert"
+	b.samlPrivateKey = "test-key"
+
+	cfg, err := b.Build()
+	require.NoError(t, err)
+
+	require.Len(t, cfg.Probod.Connectors, 1)
+	connector := cfg.Probod.Connectors[0]
+	assert.Equal(t, "MICROSOFT_365", connector.Provider)
+	assert.Equal(t, "oauth2", string(connector.Protocol))
+	rawConfig := connector.RawConfig.(probodconfig.ConnectorConfigOAuth2)
+	assert.Equal(t, "ms365-client-id", rawConfig.ClientID)
+	assert.Equal(t, "ms365-client-secret", rawConfig.ClientSecret)
+}
+
 func TestBuilder_Build_SlackConnector(t *testing.T) {
 	env := requiredEnv()
 	env["CONNECTOR_SLACK_CLIENT_ID"] = "slack-client-id"