Setting up Microsoft 365 for your environment
With your own Microsoft Entra app, your organization can use the same app for signing in with Microsoft and for Outlook, Teams, and SharePoint. You centrally determine which integrations and write actions are available. Users then only toggle their personal connections on or off in Preferences → Tools → Connections.
The integration works with supported models from OpenAI, Claude, Gemini, and Mistral. The chosen model must be able to use tools. Access always follows the rights of the signed-in Microsoft user. Organization consent does not automatically sign in all employees and does not give the AI independent access to all mailboxes.
What do you need?
- A Microsoft 365 organization with Microsoft Entra ID and accounts with access to the desired services.
- An administrator who is allowed to register an app and grant organization consent for the chosen Microsoft Graph permissions. Only an Azure subscription role is not sufficient for this; your Entra role must allow this consent.
- Administrative rights in the correct AI environment to make integrations available.
- A platform administrator who can configure the Microsoft Identity Provider for this AI environment in Google Cloud Identity Platform.
- An app registration in your own Microsoft directory, with a client secret and the two redirect URLs of the correct brand.
Signing in with Microsoft and accessing Microsoft data are two separate functions. A working Microsoft login alone does not mean Outlook, Teams, or SharePoint is set up.
1. Register one organization app
Open the Microsoft Entra admin center and go to App registrations → New registration. Use a recognizable name, for example AI-Public – your organization name. For your own organization, choose Accounts in this organizational directory only (Single tenant).
Save the following data from Overview:
| Data | For what? |
|---|---|
| Directory (tenant) ID | The Microsoft directory of your organization; this goes into the Microsoft ID field of the AI environment. |
| Application (client) ID | The registered app; this goes into the Microsoft Identity Provider. |
These two IDs are different. Do not fill in the client ID or the Firebase tenant ID in Microsoft ID.
2. Set the correct redirect URLs
Go to Authentication → Add a platform → Web. For your brand, add both of the URLs below exactly as shown. The first processes sign-in; the second processes consent for the work account integrations.
| Brand | Sign in with Microsoft | Work account integrations |
|---|---|---|
| AI-School | https://ai-school-pro.firebaseapp.com/__/auth/handler | https://europe-west1-ai-school-pro.cloudfunctions.net/completeConnectorOAuth |
| AI-Corporate | https://ai-corporate.firebaseapp.com/__/auth/handler | https://europe-west1-ai-corporate.cloudfunctions.net/completeConnectorOAuth |
| AI-Public | https://ai-public-pro.firebaseapp.com/__/auth/handler | https://europe-west1-ai-public-pro.cloudfunctions.net/completeConnectorOAuth |
Use the URLs of the brand on which your environment runs. Your own organization name or tenant ID does not need to be included in these URLs. The website URL, dashboard URL, and .web.app URL do not replace these callbacks. Register them as Web, even if you use the integration from a browser. You do not need to enable implicit token issuance or public client flow for this.
3. Create a client secret and assign permissions
Go to Certificates & secrets → Client secrets → New client secret. Choose an appropriate duration and securely save the Value as soon as it is visible. Provide the value via the agreed secure channel for platform management; the Secret ID is not the client secret. Keep track of the expiration date and replace the secret before that date, also in the Identity Provider.
Then go to API permissions → Add a permission → Microsoft Graph → Delegated permissions. Add only the permissions for the integrations and actions your organization will offer.
| Integration | Read permissions | Additional write permissions |
|---|---|---|
| Profile / basic | User.Read; the sign-in flow also requests openid, profile, email, and offline_access | None |
| Outlook Mail | Mail.Read | Drafts: Mail.ReadWrite. Send: Mail.Send. |
| Outlook Calendar | Calendars.Read | Write: Calendars.ReadWrite. |
| Microsoft Teams | Chat.Read, ChannelMessage.Read.All | Post: Team.ReadBasic.All, Channel.ReadBasic.All, ChannelMessage.Send. |
| SharePoint / OneDrive | Sites.Read.All, Files.Read.All | This work account integration does not offer write actions here. |
Mail.ReadWrite does not grant send rights; Mail.Send is required separately. Teams posting writes text messages in a chosen channel, not private chat messages. For this integration, use Delegated permissions, not Application permissions. Even with permissions containing All in the name, delegated access remains limited by the user's access.
Click Grant admin consent for your organization and verify that the chosen permissions are shown as granted. This way, employees can use the approved access without having to grant organization rights themselves. Microsoft may still request sign-in, MFA, or renewed consent depending on your policy.
4. Link the app in two places to the AI environment
Have the platform administrator select the correct environment and perform these settings:
- In Admin → Environment → Tenant: enable the login method Microsoft and fill in the Microsoft ID with the Directory (tenant) ID.
- In Google Cloud → Identity Platform → the relevant tenant → Identity providers → Microsoft: enable the provider and fill in the Application (client) ID and the client secret Value of the same Entra app.
The Identity Provider belongs to the Firebase/Identity Platform tenant of your AI environment, not to another organization or the general Admin environment. The work account integration uses the app from this provider again. The client secret should not be in user preferences, chat messages, or ordinary environment fields.
Provide platform management with the organization name, brand, Directory ID, client ID, secret value via the secure channel, expiration date, and desired integrations/permissions. An app ID alone is not sufficient.
5. Enable the integrations and write actions
Open the admin environment of your organization → Tools → MCP. Turn on the Microsoft 365 integration under Suite shortcuts. The Microsoft rows become visible; when the entire suite is off, those rows remain hidden.
Choose per integration whether it is available. In the Write actions column, select separately:
- Outlook Mail → Drafts: create and modify drafts.
- Outlook Mail → Send: actually send an existing draft.
- Outlook Calendar → Write: create and modify appointments.
- Microsoft Teams → Post: post text messages in a chosen Teams channel.
Click Save. A write action only works if both the integration and the corresponding administrative right are enabled, Microsoft has granted the necessary permissions, and the user has personally enabled the connection. The user does not receive an additional write permission form for this.
The settings must also be supported by the backend of your brand. This write extension was publicly released and tested on October 7, 2026, for OnderwijsSupport on AI-Corporate. This does not automatically mean the same extension has already been released for AI-Public, AI-Public, or any other environment. Ask platform management for confirmation if write actions are missing.
6. Check the setup
Have a user sign in to the correct AI environment and enable the desired integration according to Using Microsoft integrations. Check if Microsoft shows the name of your own Entra app.
First test a recognizable draft and an appointment without participants. Check the saved items in Outlook. Then test sending with an agreed test recipient and Teams posting in an agreed test channel. An appointment with participants can send invitations or updates. An accepted send command is not yet a confirmed delivery.
When expanding permissions, the connection tries to renew tokens. If Microsoft requires re-sign-in or consent, have the user reconnect the existing connection. No second app or separate user setting needs to be created.
Troubleshooting
| Problem | Check |
|---|---|
AADSTS50011 / redirect mismatch | Both callbacks exactly registered as Web, for the correct brand. |
| A different app name appears during consent | The correct AI environment, Directory ID, and tenant-specific Microsoft Identity Provider; then reconnect. |
| Login works, but integration does not | Also check the connector callback, Graph permissions, and organization consent. |
| Reading works, writing does not | Check admin rights, corresponding delegated Graph permission, granted consent, and backend availability. |
| Client secret invalid or expired | The Value, not the Secret ID; update new secret also in the Identity Provider. |
| Integration missing for the user | Check availability in Tools, user rights for connections, and the selected AI environment. |