Skip to main content

​
Overview

Dema connects to Microsoft 365 through Microsoft’s hosted Agent 365 / Work IQ MCP servers. Three integrations are available, and all three use one tenant setup, one sign-in, and one permission model:

Microsoft Teams

Chats, channels, messages, threads, and members

Microsoft Outlook

Mail: read, search, organize, compose, and send

Microsoft SharePoint

Sites, lists, document libraries, files, and sharing
Each integration talks to a server address unique to your Microsoft 365 tenant, which is why connecting takes an MCP URL and not just a sign-in. The agent acts only when you ask it to, and Dema asks you to confirm sensitive changes first. It signs in as whoever authorized the connection, so it cannot reach anything that person cannot open.

​
Prerequisites

Find your tenant ID in the Entra admin center under Overview → Tenant ID, or run az account show --query tenantId -o tsv.

​
One-time tenant setup

An admin does this once per Microsoft 365 tenant, not once per integration. Afterwards, anyone with a Copilot license can connect Teams, Outlook, and SharePoint.
1

Provision the Agent 365 Tools service principal

Microsoft exposes its Agent 365 tools through a shared resource called Agent 365 Tools, application ID ea9ffc3e-8a23-4a7d-836d-234d7c7565c1. Its service principal is not created in your tenant automatically, so a Global Administrator adds it once. Either method works:
With the Azure CLI installed, signed in as an admin:
Provision the service principal
The command prints the new service principal as JSON. Another object with the same value for property appId already exists means it was already provisioned.
Skip this and connecting fails with AADSTS650052, “your organization lacks a service principal”, and the McpServers permissions never appear in Entra.
2

Decide who approves the permission

Whoever connects is asked to approve one permission during sign-in:If your tenant does not allow users to approve permissions themselves, that step fails and a Global Administrator grants it for everyone once. Replace {tenant_id} with your tenant ID, open the URL, and sign in as an admin:
Admin consent URL
One grant covers all three integrations, and nobody in the tenant sees a consent prompt afterwards.

​
Build your MCP URL

Every Microsoft integration asks for an MCP URL. Copy the one for the integration you are connecting, and replace {tenant_id} with your Entra tenant ID:

​
Connect in Dema

1

Open the integration

In Dema, go to Agents → Settings → Integrations, find the Microsoft integration you want, and click Connect.
2

Enter the MCP URL

Paste the URL you built above, then click Add.
3

Sign in and approve

Sign in with a Microsoft work or school account belonging to the same tenant as the URL, and approve the permission Dema asks for.
You are returned to Dema with the integration marked as Active.
Connecting a second Microsoft integration repeats only these three steps, since the tenant setup is already done.

​
When the connection expires

Access tokens last about an hour, and Dema refreshes them in the background. A connection lapses only if the refresh window passes while Dema is disconnected, if the authorizing user’s account is disabled, or if an admin revokes consent for the Dema app. When that happens, reconnect from Agents → Settings → Integrations.

​
Troubleshooting

The URL still contains the placeholder. Replace {tenant_id} and its braces with your tenant GUID, so the address ends in /agents/tenants/<your-guid>/servers/<server-name>. Check the server name matches the list above exactly, including capitalization.
The Agent 365 Tools service principal is missing from your tenant. An admin runs the provisioning step in One-time tenant setup.
Your tenant does not allow users to approve permissions themselves, usually reported as AADSTS65001 or AADSTS90094. A Global Administrator grants it once with the admin consent URL, and connecting works normally afterwards.
Two things to check:
  • You signed in with a personal Microsoft account. Only work or school accounts are supported.
  • The account belongs to a different tenant than the one in your MCP URL. They have to be the same organization.
This is usually a missing Microsoft 365 Copilot license for the user who authorized the connection. Assign one, wait for it to propagate, then ask again. If it still fails, reconnect so Dema picks up a fresh token.
An Entra admin has to register or consent the relevant Work IQ MCP server in your tenant before anyone can grant its McpServers permission.
Still stuck? Contact support with the error message, including the Entra AADSTS code if you have one.

​
Additional resources