# Microsoft

> Connect Microsoft 365 to your agents for Outlook, OneDrive, Teams, and Calendar.

**URL:** https://inference.sh/docs/credentials/microsoft
**Last updated:** 2026-10-11

---

Connect Microsoft 365 to your agents for Outlook, OneDrive, Teams, and Calendar.

---

## Overview

A Microsoft 365 credential lets agents read and send email, manage calendar events, access OneDrive files, and interact with Teams chat.

### Why "Bring Your Own Key" (BYOK)?

Microsoft OAuth apps are registered in your Azure tenant. BYOK keeps credentials and permissions under your control.

**Benefits:**

- **Your tenant** — sign-in and consent happen in your Azure AD directory
- **Scoped permissions** — request only the Microsoft Graph scopes you need
- **Your rate limits** — API usage counts against your app registration

---

## Prerequisites

Before connecting, you'll need:

1. A Microsoft 365 account
2. Access to the [Azure Portal](https://portal.azure.com/) to register an app (admin consent may be required for some scopes)

---

## Step 1: Register an Azure app

1. Go to **Azure Portal → Microsoft Entra ID → App registrations**
2. Click **New registration**
3. Name your app (e.g., "Inference Agent")
4. Under **Supported account types**, choose the audience you need (single tenant or multi-tenant)
5. Click **Register**
6. Copy the **Application (client) ID**
7. Go to **Certificates & secrets → New client secret**, create a secret, and copy the value

---

## Step 2: Configure redirect URI

1. In your app, go to **Authentication**
2. Click **Add a platform → Web**
3. Add the redirect URI:

| Environment | Callback URL |
|-------------|-------------|
| Production | `https://app.inference.sh/settings/secrets/oauth/microsoft` |
| Staging | `https://app.staging.inference.sh/settings/secrets/oauth/microsoft` |
| Local dev | `http://localhost:3000/settings/secrets/oauth/microsoft` |

4. Save the configuration

---

## Step 3: Add API permissions

1. Go to **API permissions → Add a permission → Microsoft Graph**
2. Add **Delegated permissions** based on what your agents need (see [Capabilities](#capabilities) below)
3. Click **Grant admin consent** if your tenant requires it

---

## Step 4: Connect in inference shell

### Configure credentials

1. Go to **vaults → credentials**
2. Find **Microsoft 365** and click **Configure**
3. Enter:
   - **Client ID** (`MICROSOFT_CLIENT_ID`)
   - **Client Secret** (`MICROSOFT_CLIENT_SECRET`)
4. Optional: set **Tenant ID** (`MICROSOFT_TENANT_ID`) if you use a single-tenant app. Leave blank to use the `common` endpoint (multi-tenant).
5. Click **Save credentials**

### Authorize the connection

1. Click **Connect**
2. Sign in with Microsoft and approve the requested permissions
3. Done — the credential status shows **Connected**

---

## Adding permissions

Already connected but need more Graph access?

1. Open your connected Microsoft 365 credential
2. Click **Add Permissions**
3. Select the capabilities you need
4. Sign in at Microsoft — the consent screen targets the account you originally connected (`login_hint` from your stored account identifier)
5. Return to inference shell with updated permissions

---

## Capabilities

| Capability | Description | Required Scopes |
|------------|-------------|-----------------|
| `microsoft.mail.read` | Read email | `Mail.Read` |
| `microsoft.mail.send` | Send email | `Mail.Send` |
| `microsoft.calendar.read` | Read calendar events | `Calendars.Read` |
| `microsoft.calendar.write` | Create and edit events | `Calendars.ReadWrite` |
| `microsoft.files.read` | Read OneDrive files | `Files.Read` |
| `microsoft.files.write` | Create and edit OneDrive files | `Files.ReadWrite` |
| `microsoft.teams.read` | Read Teams messages | `Chat.Read` |
| `microsoft.teams.send` | Send Teams messages | `Chat.ReadWrite` |

---

## Triggers

| Trigger | Description | Required Scopes |
|---------|-------------|-----------------|
| `microsoft.mail.received` | New email received | `Mail.Read` |
| `microsoft.calendar.created` | Calendar event created | `Calendars.Read` |
| `microsoft.teams.message` | Teams message received | `Chat.Read` |

---

## Using in apps

Declare Microsoft requirements in your app:

```yaml
# inf.yml
credentials:
  - key: microsoft.mail.read
    description: Read incoming email

  - key: microsoft.calendar.write
    description: Schedule meetings
    optional: true
```

At runtime, your app receives:

```bash
MICROSOFT_ACCESS_TOKEN=oauth2-access-token
MICROSOFT_TOKEN_EXPIRES_AT=2026-06-03T12:00:00Z
```

Use the token with the [Microsoft Graph API](https://learn.microsoft.com/en-us/graph/overview).

---

## Next

→ [Credentials overview](/docs/credentials/overview)  
→ [Using credentials in apps](/docs/extend/credentials)