Secure Microsoft 365 access for AI agents, without a Copilot license

Microsoft 365 Graph connects your agents to mail, calendar, contacts, OneNote, Microsoft To Do tasks, and OneDrive files, plus Teams chats, channels, and meeting recordings, transcripts, and attendance data, by calling Microsoft Graph directly with each user's own signed-in token. Every call runs through your policies and is logged for audit. It needs only a standard Microsoft 365 subscription, with no Microsoft 365 Copilot license required.

Credential modesCopy Anchor Link

Microsoft 365 Graph supports bring your own app only. It does not support dynamic client registration, so your organization registers its own Entra app in Azure and supplies the client ID and secret. See Credential modes for how the modes compare.

Before you beginCopy Anchor Link

• A Microsoft Entra admin able to register an application in your tenant, and to grant admin consent for it. Any user can register an app by default unless your tenant restricts this, but the consent step needs an admin.
• Administrator access to your Agent Authority workspace, to add the resource.

Setup moves between two consoles. You copy a redirect URI in the Agent Authority console, register an app in Microsoft Entra and grant consent, then return to the console and paste the credentials. Keep both tabs open as you work.

SetupCopy Anchor Link

1. Copy the redirect URICopy Anchor Link

In the Agent Authority console, go to Resources → Add Resource and select Microsoft 365 Graph. This resource is bring-your-own-app only, so the credentials form opens as soon as you select it, with no mode to pick.

Copy the Redirect URI shown on the form. It includes your tenant's region, so copy it rather than typing it. It takes the form https://oauth.aisecurity.services.<region>.connect.secureauth.com/auth/callback.

Leave this page open. You come back to it in step 4.

2. Register an Entra app in AzureCopy Anchor Link

Sign in to portal.azure.com and go to Microsoft Entra ID → App registrations → New registration.

Register the appCopy Anchor Link

Configure:

• Name – your preferred name, for example <your-company> AI Gateway - Microsoft 365 Graph
• Supported account types – Multiple Entra ID tenants, with Allow all tenants as the sub-option, which is the default. Multi-tenant is required because the gateway's OAuth flow uses Microsoft's /common endpoint, which does not accept single-tenant apps.
• Redirect URI – choose the Web platform and paste the Redirect URI from the form in the Agent Authority console, using the Copy button next to it

Click Register.

Add the API permissionsCopy Anchor Link

On the new app's API permissions page, click Add a permission → Microsoft Graph → Delegated permissions, and add the scopes listed under Required scopes.

The three OpenID Connect scopes (offline_access, openid, profile) live under the OpenId permissions section near the bottom of the picker, which is easy to miss because they are not in the main alphabetical list.

Create a client secretCopy Anchor Link

On Certificates & secrets, click New client secret and set an expiry. Copy the secret value immediately, because Microsoft only displays it once. This is your Client Secret.

Then copy the Application (client) ID from the app's Overview page. This is your Client ID.

3. Grant admin consentCopy Anchor Link

On the API permissions page, click Grant admin consent for <your tenant> at the top of the permissions list.

4. Finish in the consoleCopy Anchor Link

Back on the Microsoft 365 Graph form in the Agent Authority console, paste the Client ID and Client Secret. Leave Token Endpoint Authentication on Auto-detect. Then click Add.

The resource is added with all tools and scopes pre-configured, and an Admin setup required dialog appears with a Setup guide button linking back to this page.

Upgrading an existing installationCopy Anchor Link

This connector's catalog entry added 13 delegated scopes for Teams chats, channels, and teams. If you installed this resource before Teams support shipped, add the new scopes listed under Required scopes to your existing Entra app registration, then re-grant admin consent.

Existing connections also need to reconnect: the new Teams tools do not appear on a connection until it is re-authenticated.

The Microsoft To Do tools add one more delegated scope, Tasks.ReadWrite. If you installed this resource before To Do support shipped, add Tasks.ReadWrite to your Entra app registration and grant admin consent again. Each user then reconnects once. Until they do, To Do calls fail with a Microsoft Graph 403 error, because the user's token doesn't carry the new scope.

Verify the connectionCopy Anchor Link

The gateway syncs the Microsoft 365 tools automatically. To check the connection end to end, ask your agent to run a request:

Show my Microsoft 365 profile

If your name and email come back, the connection is working.

How users connectCopy Anchor Link

Access is per user. Each additional user connects their own Microsoft 365 account the first time their agent calls a Microsoft 365 tool: the gateway returns a sign-in link, the user authorizes once, and the tools work from then on. Go to Connections to manage linked accounts.

Each call uses the signed-in user's own token, so Microsoft 365's own permissions control what they can reach. The gateway does not widen access beyond what the authenticated user could already do in Microsoft 365.

Available toolsCopy Anchor Link

All 150 tools ship with the catalog entry, so they appear in tool lists and policy pickers as soon as the resource is installed. Each is a direct pass-through to a Microsoft Graph operation, so the agent composes them the same way it would call Graph.

Mail – search & readCopy Anchor Link

Mail – drafts & sendingCopy Anchor Link

Mail – manage & organizeCopy Anchor Link

Mail – inbox rulesCopy Anchor Link

Mail – attachmentsCopy Anchor Link

Calendar – eventsCopy Anchor Link

Calendar – invitationsCopy Anchor Link

Calendar – calendars & schedulingCopy Anchor Link

ContactsCopy Anchor Link

Teams meetingsCopy Anchor Link

Teams – chatsCopy Anchor Link

Teams – teams & channelsCopy Anchor Link

OneNoteCopy Anchor Link

Microsoft To Do – lists & tasksCopy Anchor Link

Start with list_todo_lists to find a list's ID, then pass it to the task tools. Every user has a default Tasks list.

Microsoft To Do – checklist items, links & attachmentsCopy Anchor Link

Files & search (OneDrive + SharePoint)Copy Anchor Link

Read-only file access and search across the user's OneDrive and any SharePoint document libraries they can reach. To search a specific library, resolve its drive-id first. Use list_drives for the user's own OneDrive and list_site_drives for a SharePoint site's document libraries.

People, presence & searchCopy Anchor Link

Profile & settingsCopy Anchor Link

Known limitationsCopy Anchor Link

A few Graph operations can't be driven by a pure JSON pass-through tool, so they aren't exposed:

• OneNote page creation is not available. You can create notebooks and sections and list, read, and delete pages, but creating a page requires a multipart HTML request body that a pass-through tool can't send.
• Meeting recording content download is not available. list_recordings returns recording metadata; downloading the recording video is a binary stream, not a pass-through call. Transcript content is available via get_transcript_content.
• Large attachment upload is not available. Uploading files over 3 MB requires a chunked upload session. Attachments under 3 MB work via add_attachment for mail and add_todo_attachment for To Do tasks.
• To Do open extensions are not exposed. Graph's custom-data extensions on task lists and tasks are a developer feature with no To Do user-facing equivalent, so they're left out.
• Online-meeting AI insights are not available. Microsoft's Copilot-generated meeting summaries and action items are a beta-only API, not present in the pinned Graph spec this connector generates from.

Required scopesCopy Anchor Link

Add all of these under API permissions as delegated permissions, in step 2. Each tool requests the least-privilege scope Microsoft's own permissions data maps to its operation, and the catalog requests the collapsed union across all 150 tools.

• openid, profile – sign-in identity
• offline_access – maintain access when the user is offline
• User.Read – read the signed-in user's profile
• Mail.ReadWrite – list, search, read, draft, update, move, and delete mail, folders, and attachments
• Mail.Send – send mail directly, reply, reply all, and forward
• Calendars.ReadWrite – read, create, update, delete, cancel, and respond to calendar events and calendars
• Calendars.Read.Shared – suggest meeting times and read free/busy from attendees' shared calendars
• Contacts.ReadWrite – read, create, update, and delete contacts and contact folders
• MailboxSettings.ReadWrite – read and update mailbox settings, and manage inbox rules
• Notes.ReadWrite – read and create OneNote notebooks, sections, and pages
• Tasks.ReadWrite – read, create, update, and delete Microsoft To Do task lists, tasks, checklist items, linked resources, and attachments
• Files.Read.All – list OneDrive drives and SharePoint document libraries, and search and browse their files
• OnlineMeetings.ReadWrite – create, read, update, and delete the user's online meetings
• OnlineMeetingTranscript.Read.All – list and read Teams meeting transcripts
• OnlineMeetingRecording.Read.All – list Teams meeting recordings
• OnlineMeetingArtifact.Read.All – read meeting attendance reports and records
• People.Read – read the user's relevant people list
• Presence.Read – read the user's presence
• Chat.Create – create new chats
• Chat.ReadWrite – read and write chat messages
• ChatMember.Read – list chat members
• ChatMessage.Send – send and react to chat messages
• ChannelMessage.Send – send and react to channel messages
• Team.ReadBasic.All – list and read teams
• TeamMember.Read.All – list team members
• Channel.ReadBasic.All – list and read channels
• Channel.Create – create channels
• ChannelSettings.ReadWrite.All – update channel properties
• ChannelMessage.Read.All – read channel messages
• TeamsTab.Read.All – list a channel's tabs
• TeamsAppInstallation.ReadForUser – list the user's installed Teams apps

Policy examplesCopy Anchor Link

Rules are evaluated top to bottom and the first match wins. Allow rules on their own restrict nothing, your org starts with a seeded Allow all rule, so any tools your allows don't cover still fall through to it. A restrictive recipe needs a catch-all deny scoped to this resource, ordered below the allows. New rules are inserted at the top of the list, so create them in reverse order or drag them into place. See Policies.

• Read-only access. Allow list_*, get_*, and find_*, then deny * below them.
• Block sending and replies. Deny send_*, reply_*, and forward_* above any allow rules.
• Block destructive operations. Deny delete_*, cancel_*, move_*, and update_*.
• Allow mail triage but block calendar changes. Allow *message*, get_*, and list_*, then deny *event*, then deny * (list_events still reads if you allow it explicitly above the *event* deny).
• Allow reading Teams meeting artifacts only. Allow list_transcripts, get_transcript_content, list_recordings, and list_attendance_*, then deny *.
• Allow reading Teams chats and channels, block sending. Allow list_chat*, get_chat*, list_channel*, get_channel*, list_team*, get_team*, list_joined_teams, list_my_*, list_pinned_chat_messages, then deny *.
• Allow reading To Do tasks only. Allow list_todo_* and get_todo_*, then deny *. The catalog still requests Tasks.ReadWrite at sign-in, so the policy, not the token, is what keeps To Do read-only.
• Allow full access for a specific agent. Scope an allow rule for * to that agent on this MCP server.
• Block destructive tools. Add a deny rule with the built-in destructive tag (Tools pill) for this resource (MCP pill).

Tool patterns are case-sensitive and match exactly unless they contain *. This connector's tools are snake_case, for example list_messages.

Next stepsCopy Anchor Link

• Create a policy – start from the read-only pattern in Policy examples above.
• Connections – manage the Microsoft 365 accounts your users have linked.