Microsoft 365

Category: Productivity / Microsoft 365
Connect by: Connect with OAuth
Official API docs: https://learn.microsoft.com/en-us/graph/api/overview?view=graph-rest-1.0

What the agent can see

Capability	API call	Risk	Needs approval
List messages in the signed-in user's Outlook mailbox. (docs)	`GET /me/messages`	🟢 low	— no
List events in the signed-in user's default calendar. (docs)	`GET /me/events`	🟢 low	— no
List the children (files & folders) in the root of the user's OneDrive. (docs)	`GET /me/drive/root/children`	🟢 low	— no
Read a range (by address) from a worksheet in an Excel workbook in the drive. (docs)	`GET /me/drive/items/{id}/workbook/worksheets/{id\|name}/range(address='{address}')`	🟢 low	— no

What the agent can do

Capability	API call	Risk	Needs approval
Send a new mail message as the signed-in user (external contact). (docs)	`POST /me/sendMail`	🔴 high	✅ yes
Create an event in the signed-in user's default calendar (may invite attendees). (docs)	`POST /me/events`	🟡 medium	✅ yes
Upload (or replace) the contents of a small file (<=250 MB) in the user's drive. (docs)	`PUT /me/drive/root:/{path}:/content`	🟡 medium	✅ yes
Update the values of a range (by address) in a worksheet in an Excel workbook. (docs)	`PATCH /me/drive/items/{id}/workbook/worksheets/{id\|name}/range(address='{address}')`	🟡 medium	✅ yes

Connecting it

You provide: Microsoft 365 account (OAuth)
Where to get it: Register an app in the Microsoft Entra admin center (App registrations), add Microsoft Graph DELEGATED permissions (Mail.Read, Mail.Send, Calendars.ReadWrite, Files.ReadWrite.All, Sites.ReadWrite.All), grant admin consent, then connect via OAuth. All ops use delegated permissions (the agent acts as the signed-in user).
Permissions/scopes: https://graph.microsoft.com/Mail.Read, https://graph.microsoft.com/Mail.Send, https://graph.microsoft.com/Calendars.ReadWrite, https://graph.microsoft.com/Files.ReadWrite.All, https://graph.microsoft.com/Sites.ReadWrite.All, offline_access

Account setup

Account needed: A Microsoft 365 tenant with Exchange Online (Outlook) and OneDrive/SharePoint.
App registration: Register an app in Microsoft Entra ID (client id + secret + redirect URI); add delegated Graph permissions Mail.Read, Mail.Send, Calendars.ReadWrite, Files.ReadWrite.All, Sites.ReadWrite.All.
Verification required: The .All file/site permissions (Files.ReadWrite.All, Sites.ReadWrite.All) require a tenant admin to grant consent; Mail/Calendar scopes can be user-consented. All ops are delegated (no app-only/headless path here).
Testing: Use your own Microsoft 365 dev tenant (Microsoft 365 Developer Program).

Limits

Microsoft Graph applies per-app/per-tenant throttling; on exceed it returns HTTP 429 Too Many Requests with a Retry-After header (seconds to wait). Writes throttle sooner than reads. See https://learn.microsoft.com/en-us/graph/throttling.