> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dema.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Microsoft Outlook
> Let the Dema Agent read, search, send, and manage Outlook mail messages and folders through Microsoft's hosted Mail MCP server.
export const Agent365SetupIntro = () => <>
Microsoft's Agent 365 tools are exposed by a shared resource called **Agent 365 Tools** (application ID `ea9ffc3e-8a23-4a7d-836d-234d7c7565c1`). Its service principal is **not** provisioned in your tenant automatically, so an admin has to create it once before anyone can connect.
If you skip this step, the connection fails with **AADSTS650052** ("your organization lacks a service principal") and the required permissions never appear in Entra.
;
export const MicrosoftAgentPreviewNote = () =>
Microsoft Teams, Outlook, and SharePoint are currently **preview** integrations. They are built on Microsoft's Agent 365 / Work IQ MCP servers, which Microsoft ships as a preview feature — tool behavior may change, and your workspace may need the preview enabled before the integration appears.
;
## Overview
Once Microsoft Outlook is connected, the Dema Agent can read, search, and organize your Outlook mail, and compose and send messages on your behalf. Use it to pull context from your inbox into a conversation or to send a Dema summary by email.
Outlook is served by Microsoft's official hosted **Work IQ / Agent 365** Mail MCP server. The agent acts as the user who authorizes the connection, so it only sees the mail that user can already access.
Outlook covers **mail** only. Outlook Calendar is a separate Microsoft MCP server and is not part of this integration.
***
## Prerequisites
* A **Microsoft 365** organization (work or school account). Personal Microsoft accounts are not supported.
* A **Microsoft 365 Copilot** license for the user who connects. Work IQ is backed by the Microsoft 365 Copilot Chat API, so tool calls fail without it.
* A **Microsoft Entra (Azure AD) administrator** to complete the one-time tenant setup below.
* Your **Microsoft Entra tenant ID** (a GUID). Find it in the [Entra admin center](https://entra.microsoft.com) under **Overview → Tenant ID**.
***
## One-time tenant setup (admin)
A Global Administrator runs this once per tenant, using the [Azure CLI](https://learn.microsoft.com/cli/azure/install-azure-cli):
```bash theme={null}
az ad sp create --id ea9ffc3e-8a23-4a7d-836d-234d7c7565c1
```
Prefer a UI? In [Microsoft Graph Explorer](https://developer.microsoft.com/graph/graph-explorer), signed in as an admin, send `POST https://graph.microsoft.com/v1.0/servicePrincipals` with body `{"appId": "ea9ffc3e-8a23-4a7d-836d-234d7c7565c1"}`. A `201 Created` response means it worked.
After the service principal exists, grant tenant-wide admin consent for the Mail permission (`McpServers.Mail.All`) when prompted during the first connection, or ahead of time from the [Microsoft 365 admin center](https://admin.microsoft.com) under **Agents → Tools**.
This setup is shared across the Microsoft Teams, Outlook, and SharePoint integrations. If you already provisioned the service principal for one of them, you only need to consent to the Mail permission here.
***
## Connect Microsoft Outlook
In Dema, go to **Agents → Settings → Integrations**, find **Microsoft Outlook**, and click **Connect**.
Enter the **MCP URL** in the form below, replacing `{tenant_id}` with your Entra tenant ID:
```
https://agent365.svc.cloud.microsoft/agents/tenants/{tenant_id}/servers/mcp_MailTools
```
Click **Add**, sign in with your Microsoft **work or school** account, and approve the permission Dema requests. You are returned to Dema with the integration marked as Active.
Consider connecting a dedicated agent mailbox rather than your personal inbox, and share only what the agent needs. See [Best practices](/guides/agent/integrations/overview#best-practices) in the integrations overview.
***
## Scopes Dema requests
| Scope | What it allows |
| --------------------- | ------------------------------------------------------------------------------------ |
| `McpServers.Mail.All` | Read, search, list, compose, and send Outlook mail and manage folders on your behalf |
| `offline_access` | Refresh access so you do not have to reconnect frequently |
The session runs as the user who authorizes it, so the agent only sees the mailbox that user can already access.
***
## Troubleshooting
* **AADSTS650052 / "your organization lacks a service principal".** The Agent 365 Tools service principal is not provisioned in your tenant. An admin must run the provisioning step above.
* **Sign-in rejected.** You are using a personal Microsoft account. Use a work or school (organizational) account.
* **The agent gets no access or a 403.** The signing-in user is missing a Microsoft 365 Copilot license. Assign one and allow time for it to propagate.
* **Dema says the URL is invalid.** The MCP URL must be `https://agent365.svc.cloud.microsoft/agents/tenants/{tenant_id}/servers/mcp_MailTools` with `{tenant_id}` replaced by your real tenant GUID.
* **Permission not grantable in Entra.** An Entra admin must register/consent the Work IQ Mail MCP server (`mcp_MailTools`) before the `McpServers.Mail.All` permission can be consented.
***
## Additional resources
* [Set up the Agent 365 Tools service principal](https://learn.microsoft.com/microsoft-agent-365/developer/tooling)
* [Manage tools for agents in the Microsoft 365 admin center](https://learn.microsoft.com/microsoft-agent-365/bring-your-own-mcp)
* [Work IQ API permissions](https://learn.microsoft.com/microsoft-365/copilot/extensibility/work-iq/permissions)