Secure Microsoft 365 access for AI agents, without a Copilot license

Microsoft 365 Graph connects your agents to mail, calendar, contacts, OneNote, and OneDrive files, plus Teams chats, channels, and meeting recordings, transcripts, and attendance data, by calling Microsoft Graph directly with each user's own signed-in token. Every call runs through your policies and is logged for audit. It needs only a standard Microsoft 365 subscription, with no Microsoft 365 Copilot license required.

Credential modes

Microsoft 365 Graph supports bring your own app only. It does not support dynamic client registration, so your organization registers its own Entra app in Azure and supplies the client ID and secret. See Credential modes for how the modes compare.

Before you begin

• A Microsoft Entra admin able to register an application in your tenant, and to grant admin consent for it. Any user can register an app by default unless your tenant restricts this, but the consent step needs an admin.
• Administrator access to your Agent Authority workspace, to add the resource.

Setup moves between two consoles. You copy a redirect URI in the Agent Authority console, register an app in Microsoft Entra and grant consent, then return to the console and paste the credentials. Keep both tabs open as you work.

Setup

1. Copy the redirect URI

In the Agent Authority console, go to Resources → Add Resource and select Microsoft 365 Graph. This resource is bring-your-own-app only, so the credentials form opens as soon as you select it, with no mode to pick.

Copy the Redirect URI shown on the form. It includes your tenant's region, so copy it rather than typing it. It takes the form https://oauth.aisecurity.services.<region>.connect.secureauth.com/auth/callback.

Leave this page open. You come back to it in step 4.

2. Register an Entra app in Azure

Sign in to portal.azure.com and go to Microsoft Entra ID → App registrations → New registration.

Register the app

Configure:

• Name – your preferred name, for example <your-company> AI Gateway - Microsoft 365 Graph
• Supported account types – Multiple Entra ID tenants, with Allow all tenants as the sub-option, which is the default. Multi-tenant is required because the gateway's OAuth flow uses Microsoft's /common endpoint, which does not accept single-tenant apps.
• Redirect URI – choose the Web platform and paste the Redirect URI from the form in the Agent Authority console, using the Copy button next to it

Click Register.

Add the API permissions

On the new app's API permissions page, click Add a permission → Microsoft Graph → Delegated permissions, and add the scopes listed under Required scopes.

The three OpenID Connect scopes (offline_access, openid, profile) live under the OpenId permissions section near the bottom of the picker, which is easy to miss because they are not in the main alphabetical list.

Create a client secret

On Certificates & secrets, click New client secret and set an expiry. Copy the secret value immediately, because Microsoft only displays it once. This is your Client Secret.

Then copy the Application (client) ID from the app's Overview page. This is your Client ID.

3. Grant admin consent

On the API permissions page, click Grant admin consent for <your tenant> at the top of the permissions list.

4. Finish in the console

Back on the Microsoft 365 Graph form in the Agent Authority console, paste the Client ID and Client Secret. Leave Token Endpoint Authentication on Auto-detect. Then click Add.

The resource is added with all tools and scopes pre-configured, and an Admin setup required dialog appears with a Setup guide button linking back to this page.

Upgrading an existing installation

This connector's catalog entry added 13 delegated scopes for Teams chats, channels, and teams. If you installed this resource before Teams support shipped, add the new scopes listed under Required scopes to your existing Entra app registration, then re-grant admin consent.

Existing connections also need to reconnect: the new Teams tools do not appear on a connection until it is re-authenticated.

Verify the connection

The gateway syncs the Microsoft 365 tools automatically. To check the connection end to end, ask your agent to run a request:

Show my Microsoft 365 profile

If your name and email come back, the connection is working.

How users connect

Access is per user. Each additional user connects their own Microsoft 365 account the first time their agent calls a Microsoft 365 tool: the gateway returns a sign-in link, the user authorizes once, and the tools work from then on. Go to Connections to manage linked accounts.

Each call uses the signed-in user's own token, so Microsoft 365's own permissions control what they can reach. The gateway does not widen access beyond what the authenticated user could already do in Microsoft 365.

Available tools

All 125 tools ship with the catalog entry, so they appear in tool lists and policy pickers as soon as the resource is installed. Each is a direct pass-through to a Microsoft Graph operation, so the agent composes them the same way it would call Graph.

Mail – search & read

Mail – drafts & sending

Mail – manage & organize

Mail – inbox rules

Mail – attachments

Calendar – events

Calendar – invitations

Calendar – calendars & scheduling

Contacts

Teams meetings

Teams – chats

Teams – teams & channels

OneNote

Files & search (OneDrive + SharePoint)

Read-only file access and search across the user's OneDrive and any SharePoint document libraries they can reach. To search a specific library, resolve its drive-id with list_drives first.

People, presence & search

Profile & settings

Known limitations

A few Graph operations can't be driven by a pure JSON pass-through tool, so they aren't exposed:

• OneNote page creation is not available. You can create notebooks and sections and list, read, and delete pages, but creating a page requires a multipart HTML request body that a pass-through tool can't send.
• Meeting recording content download is not available. list_recordings returns recording metadata; downloading the recording video is a binary stream, not a pass-through call. Transcript content is available via get_transcript_content.
• Large attachment upload is not available. Uploading files over 3 MB requires a chunked upload session. Attachments under 3 MB work via add_attachment.
• Online-meeting AI insights are not available. Microsoft's Copilot-generated meeting summaries and action items are a beta-only API, not present in the pinned Graph spec this connector generates from.

Required scopes

Add all of these under API permissions as delegated permissions, in step 2. Each tool requests the least-privilege scope Microsoft's own permissions data maps to its operation, and the catalog requests the collapsed union across all 125 tools.

• openid, profile – sign-in identity
• offline_access – maintain access when the user is offline
• User.Read – read the signed-in user's profile
• Mail.ReadWrite – list, search, read, draft, update, move, and delete mail, folders, and attachments
• Mail.Send – send mail directly, reply, reply all, and forward
• Calendars.ReadWrite – read, create, update, delete, cancel, and respond to calendar events and calendars
• Calendars.Read.Shared – suggest meeting times and read free/busy from attendees' shared calendars
• Contacts.ReadWrite – read, create, update, and delete contacts and contact folders
• MailboxSettings.ReadWrite – read and update mailbox settings, and manage inbox rules
• Notes.ReadWrite – read and create OneNote notebooks, sections, and pages
• Files.Read.All – list the OneDrive drives the user can access
• OnlineMeetings.ReadWrite – create, read, update, and delete the user's online meetings
• OnlineMeetingTranscript.Read.All – list and read Teams meeting transcripts
• OnlineMeetingRecording.Read.All – list Teams meeting recordings
• OnlineMeetingArtifact.Read.All – read meeting attendance reports and records
• People.Read – read the user's relevant people list
• Presence.Read – read the user's presence
• Chat.Create – create new chats
• Chat.ReadWrite – read and write chat messages
• ChatMember.Read – list chat members
• ChatMessage.Send – send and react to chat messages
• ChannelMessage.Send – send and react to channel messages
• Team.ReadBasic.All – list and read teams
• TeamMember.Read.All – list team members
• Channel.ReadBasic.All – list and read channels
• Channel.Create – create channels
• ChannelSettings.ReadWrite.All – update channel properties
• ChannelMessage.Read.All – read channel messages
• TeamsTab.Read.All – list a channel's tabs
• TeamsAppInstallation.ReadForUser – list the user's installed Teams apps

Policy examples

Rules are evaluated top to bottom and the first match wins. Allow rules on their own restrict nothing, your org starts with a seeded Allow all rule, so any tools your allows don't cover still fall through to it. A restrictive recipe needs a catch-all deny scoped to this resource, ordered below the allows. New rules are inserted at the top of the list, so create them in reverse order or drag them into place. See Policies.

• Read-only access. Allow list_*, get_*, and find_*, then deny * below them.
• Block sending and replies. Deny send_*, reply_*, and forward_* above any allow rules.
• Block destructive operations. Deny delete_*, cancel_*, move_*, and update_*.
• Allow mail triage but block calendar changes. Allow *message*, get_*, and list_*, then deny *event*, then deny * (list_events still reads if you allow it explicitly above the *event* deny).
• Allow reading Teams meeting artifacts only. Allow list_transcripts, get_transcript_content, list_recordings, and list_attendance_*, then deny *.
• Allow reading Teams chats and channels, block sending. Allow list_chat*, get_chat*, list_channel*, get_channel*, list_team*, get_team*, list_joined_teams, list_my_*, list_pinned_chat_messages, then deny *.
• Allow full access for a specific agent. Scope an allow rule for * to that agent on this MCP server.

Tool patterns are case-sensitive and match exactly unless they contain *. This connector's tools are snake_case, for example list_messages.

Next steps

• Create a policy – start from the read-only pattern in Policy examples above.
• Connections – manage the Microsoft 365 accounts your users have linked.