Microsoft

Connect Microsoft 365 to your agents for Outlook, OneDrive, Teams, and Calendar.

Overview

A Microsoft 365 credential lets agents read and send email, manage calendar events, access OneDrive files, and interact with Teams chat.

Why "Bring Your Own Key" (BYOK)?

Microsoft OAuth apps are registered in your Azure tenant. BYOK keeps credentials and permissions under your control.

Benefits:

• Your tenant — sign-in and consent happen in your Azure AD directory
• Scoped permissions — request only the Microsoft Graph scopes you need
• Your rate limits — API usage counts against your app registration

Prerequisites

Before connecting, you'll need:

1. A Microsoft 365 account
2. Access to the Azure Portal to register an app (admin consent may be required for some scopes)

Step 1: Register an Azure app

1. Go to Azure Portal → Microsoft Entra ID → App registrations
2. Click New registration
3. Name your app (e.g., "Inference Agent")
4. Under Supported account types, choose the audience you need (single tenant or multi-tenant)
5. Click Register
6. Copy the Application (client) ID
7. Go to Certificates & secrets → New client secret, create a secret, and copy the value

Step 2: Configure redirect URI

1. In your app, go to Authentication
2. Click Add a platform → Web
3. Add the redirect URI:

1. Save the configuration

Step 3: Add API permissions

1. Go to API permissions → Add a permission → Microsoft Graph
2. Add Delegated permissions based on what your agents need (see Capabilities below)
3. Click Grant admin consent if your tenant requires it

Step 4: Connect in inference shell

Configure credentials

1. Go to Vault → credentials
2. Find Microsoft 365 and click Configure
3. Enter:
   • Client ID (MICROSOFT_CLIENT_ID)
   • Client Secret (MICROSOFT_CLIENT_SECRET)
4. Optional: set Tenant ID (MICROSOFT_TENANT_ID) if you use a single-tenant app. Leave blank to use the common endpoint (multi-tenant).
5. Click Save credentials

Authorize the connection

1. Click Connect
2. Sign in with Microsoft and approve the requested permissions
3. Done — the credential status shows Connected

Capabilities

Triggers

Using in apps

Declare Microsoft requirements in your app:

1# inf.yml2credentials:3  - key: microsoft.mail.read4    description: Read incoming email56  - key: microsoft.calendar.write7    description: Schedule meetings8    optional: true

At runtime, your app receives:

1MICROSOFT_ACCESS_TOKEN=oauth2-access-token2MICROSOFT_TOKEN_EXPIRES_AT=2026-06-03T12:00:00Z

Use the token with the Microsoft Graph API.

Next

→ Credentials overview
→ Using credentials in apps