Secure Microsoft 365 access for AI agents, without a Copilot license

Microsoft 365 Graph connects your agents to mail, calendar, contacts, OneNote, and OneDrive files, plus Teams chats, channels, and meeting recordings, transcripts, and attendance data, by calling Microsoft Graph directly with each user's own signed-in token. Every call runs through your policies and is logged for audit. It needs only a standard Microsoft 365 subscription, no Microsoft 365 Copilot license required.

Prerequisites

• A Microsoft Entra admin able to register an application in your tenant (any user can register an app by default unless your tenant restricts this).

Setup

Adding this resource takes you straight to the Entra app form, there is no credential-mode picker.

1. Navigate to Resources and click Add Resource
2. Select Microsoft 365 Graph from the catalog
3. The Redirect URI, Client ID, Client Secret, and Token Endpoint Authentication fields appear immediately. Copy the redirect URI, then follow Bring your own app below
4. Return to this page, paste the resulting Client ID and Client Secret, and click Add

The resource is added with all tools and scopes pre-configured, and an Admin setup required dialog appears with a Setup guide button linking back to this page. Each user connects their own Microsoft 365 account via OAuth when they first use a Microsoft 365 tool. Navigate to Connections to manage linked accounts.

Upgrading an existing installation

This connector's catalog entry added 13 new delegated scopes for Teams chats, channels, and teams. If you installed this resource before Teams support shipped, add the new scopes listed under Required scopes to your existing Entra app registration, then re-grant admin consent. Existing user connections also need to reconnect their accounts: the new Teams tools won't appear on a connection until it's re-authenticated.

Bring your own app

Every organization registers its own Entra application for this connector. The flow has three phases: collect the redirect URI from the Add Resource page above, register and configure the app in Microsoft Entra, and then return to that page with the credentials.

Get the redirect URI. In the Agent Authority console, go to Resources > Add Resource > Microsoft 365 Graph and copy the redirect URI shown on the page. Keep the page open, you will return to it at the end of this flow to paste the Client ID and Client Secret.

Register and configure the app in Entra. Sign in to portal.azure.com and navigate to Microsoft Entra ID > App registrations > New registration.

1. Register the app. Configure:

• Name — your preferred name (for example, <your-company> AI Gateway - Microsoft 365 Graph)
• Supported account types — Multiple Entra ID tenants, with Allow all tenants as the sub-option (the default). Multi-tenant is required because the SecureAuth gateway's OAuth flow uses Microsoft's /common endpoint, which does not accept single-tenant apps.
• Redirect URI — choose Web platform and paste the redirect URI you copied from the Agent Authority console

Click Register.

2. Configure API permissions. On the new app's API permissions page, click Add a permission > Microsoft Graph > Delegated permissions, and add the scopes listed under Required scopes below. The three OIDC scopes (offline_access, openid, profile) live under the OpenId permissions section near the bottom of the picker, easy to miss because they are not in the main alphabetical list.

3. Grant admin consent (required). After adding permissions, click Grant admin consent for <your tenant> at the top of the API permissions list. Several of the Teams scopes below are not user-consentable, so this step is required: without it, users will fail to connect with an AADSTS65001 consent error.

4. Create a client secret. On Certificates & secrets, click New client secret, set an expiry, and copy the secret value immediately, Microsoft only displays it once. This is your Client Secret.

5. Copy the Application (client) ID from the app's Overview page.

Return with your credentials. Go back to the Add Resource page in the Agent Authority console (still open from the first step). Paste the Client ID and Client Secret, leave Token Endpoint Authentication on Auto-detect, then click Add. The resource is now configured for your tenant, and users can begin connecting their accounts through Connections.

Available tools

All 123 tools ship with the catalog entry, so they appear in tool lists and policy pickers as soon as the resource is installed. Each is a direct pass-through to a Microsoft Graph operation, so the agent composes them the same way it would call Graph.

Mail — search & read

Mail — drafts & sending

Mail — manage & organize

Mail — inbox rules

Mail — attachments

Calendar — events

Calendar — invitations

Calendar — calendars & scheduling

Contacts

Teams meetings

Teams — chats

Teams — teams & channels

OneNote

Files & search (OneDrive + SharePoint)

Read-only file access and search across the user's OneDrive and any SharePoint document libraries they can reach. To search a specific library, resolve its drive-id with list_drives first.

People, presence & search

Profile & settings

Required scopes

Each tool requests the least-privilege scope Microsoft's own permissions data maps to its operation, then the catalog requests the collapsed union across all 123 tools:

• openid, profile — sign-in identity
• offline_access — maintain access when the user is offline
• User.Read — read the signed-in user's profile
• Mail.ReadWrite — list, search, read, draft, update, move, and delete mail, folders, and attachments
• Mail.Send — send mail directly, reply, reply all, and forward
• Calendars.ReadWrite — read, create, update, delete, cancel, and respond to calendar events and calendars
• Calendars.Read.Shared — suggest meeting times and read free/busy from attendees' shared calendars
• Contacts.ReadWrite — read, create, update, and delete contacts and contact folders
• MailboxSettings.ReadWrite — read and update mailbox settings, and manage inbox rules
• Notes.ReadWrite — read and create OneNote notebooks, sections, and pages
• Files.Read.All — list the OneDrive drives the user can access
• OnlineMeetings.ReadWrite — create, read, update, and delete the user's online meetings
• OnlineMeetingTranscript.Read.All — list and read Teams meeting transcripts
• OnlineMeetingRecording.Read.All — list Teams meeting recordings
• OnlineMeetingArtifact.Read.All — read meeting attendance reports and records
• People.Read — read the user's relevant people list
• Presence.Read — read the user's presence
• Chat.Create — create new chats
• Chat.ReadWrite — read and write chat messages
• ChatMember.Read — list chat members
• ChatMessage.Send — send and react to chat messages
• ChannelMessage.Send — send and react to channel messages
• Team.ReadBasic.All — list and read teams
• TeamMember.Read.All — list team members
• Channel.ReadBasic.All — list and read channels
• Channel.Create — create channels
• ChannelSettings.ReadWrite.All — update channel properties
• ChannelMessage.Read.All — read channel messages
• TeamsTab.Read.All — list a channel's tabs
• TeamsAppInstallation.ReadForUser — list the user's installed Teams apps

Known limitations

A few Graph operations can't be driven by a pure JSON pass-through tool, so they aren't exposed:

• OneNote page creation is not available. You can create notebooks and sections and list, read, and delete pages, but creating a page requires a multipart HTML request body that a pass-through tool can't send.
• Meeting recording content download is not available. list_recordings returns recording metadata; downloading the recording video is a binary stream, not a pass-through call. Transcript content is available via get_transcript_content.
• Large attachment upload is not available. Uploading files over 3 MB requires a chunked upload session. Attachments under 3 MB work via add_attachment.
• Online-meeting AI insights are not available. Microsoft's Copilot-generated meeting summaries and action items are a beta-only API, not present in the pinned Graph spec this connector generates from.

Policy examples

Rules are evaluated top to bottom and the first match wins. Allow rules on their own restrict nothing, your org starts with a seeded Allow all rule, so any tools your allows don't cover still fall through to it. A restrictive recipe needs a catch-all deny scoped to this resource, ordered below the allows. New rules are inserted at the top of the list, so create them in reverse order or drag them into place. See Policies.

• Read-only access. Allow list_*, get_*, and find_*, then deny * below them.
• Block sending and replies. Deny send_*, reply_*, and forward_* above any allow rules.
• Block destructive operations. Deny delete_*, cancel_*, move_*, and update_*.
• Allow mail triage but block calendar changes. Allow *message*, get_*, and list_*, then deny *event*, then deny * (list_events still reads if you allow it explicitly above the *event* deny).
• Allow reading Teams meeting artifacts only. Allow list_transcripts, get_transcript_content, list_recordings, and list_attendance_*, then deny *.
• Allow reading Teams chats and channels, block sending. Allow list_chat*, get_chat*, list_channel*, get_channel*, list_team*, get_team*, list_joined_teams, list_my_*, list_pinned_chat_messages, then deny *.
• Allow full access for a specific agent. Scope an allow rule for * to that agent on this MCP server.

Tool patterns are case-sensitive and match exactly unless they contain *. This connector's tools are snake_case, for example list_messages.

Next steps

• Create a policy, start from the read-only pattern in Policy examples above.
• Credential modes, compare bringing your own app against other resources' options before you install.