> For the complete documentation index, see [llms.txt](https://docs.stackai.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stackai.com/workflow-builder/apps/outlook/set-up-a-custom-outlook-oauth-connector.md).

# Set up a custom Outlook OAuth connector

Create a custom OAuth connector when authentication must run through your Microsoft Entra app. This applies to single-tenant and on-premises deployments. It also applies when you must restrict the requested scopes.

You'll register an app in Microsoft Entra ID, grant delegated Microsoft Graph permissions, create a client secret, and add those credentials to StackAI.

{% stepper %}
{% step %}

### Register an app in Microsoft Entra ID

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/) or [Azure portal](https://portal.azure.com/).
2. Go to **Identity** → **Applications** → **App registrations**.
3. Select **New registration**.
4. Complete the form:
   * **Name:** Use a descriptive name, such as `StackAI Outlook OAuth2 Connector`.
   * **Supported account types:** Select **Single tenant**.
   * **Redirect URI:** Select **Web**. Enter `https://www.stackai.com/auth`.

{% hint style="info" %}
For single-tenant and on-premises deployments, the redirect URI is instance-specific. StackAI displays the correct URI when you create the connector.
{% endhint %}

5. Select **Register**.
6. On the app's **Overview** page, copy these values:
   * **Application (client) ID:** Use this as the **Client ID** in StackAI.
   * **Directory (tenant) ID:** Use this as the **Tenant ID** in StackAI.
     {% endstep %}

{% step %}

### Add Microsoft Graph API permissions

A custom OAuth2 connector uses delegated Microsoft Graph permissions. The app acts on behalf of the signed-in user.

<table><thead><tr><th width="230">Permission</th><th width="150">Type</th><th>Purpose</th></tr></thead><tbody><tr><td><code>User.Read</code></td><td>Delegated</td><td>Read the signed-in user's profile for health checks via <code>/me</code>.</td></tr><tr><td><code>Mail.Read</code></td><td>Delegated</td><td>Read emails for the Search Emails action.</td></tr><tr><td><code>Mail.ReadWrite</code></td><td>Delegated</td><td>Create drafts, add attachments, modify messages, and reply or forward.</td></tr><tr><td><code>Mail.Send</code></td><td>Delegated</td><td>Send emails as the signed-in user.</td></tr><tr><td><code>MailboxSettings.Read</code></td><td>Delegated</td><td>Get the list of email categories.</td></tr><tr><td><code>Calendars.ReadWrite</code></td><td>Delegated</td><td>Read calendars and create events.</td></tr><tr><td><code>offline_access</code></td><td>Delegated</td><td>Obtain refresh tokens.</td></tr><tr><td><code>openid</code></td><td>Delegated</td><td>OpenID Connect sign-in.</td></tr><tr><td><code>profile</code></td><td>Delegated</td><td>Read basic profile information.</td></tr><tr><td><code>email</code></td><td>Delegated</td><td>Read the user's email address.</td></tr></tbody></table>

{% hint style="info" %}
Confirm the scopes for your intended actions in [Outlook connector settings](https://www.stackai.com/settings/connectors/outlook).
{% endhint %}

1. In the app registration, go to **API permissions** → **Add a permission**.
2. Select **Microsoft Graph**.
3. Select **Delegated permissions**.
4. Select each required permission from the table.
5. Select **Add permissions**.
   {% endstep %}

{% step %}

### Grant admin consent

Pre-authorize high-privilege permissions for your tenant. This avoids individual consent prompts and tenant policy blocks.

1. In the app registration, go to **API permissions**.
2. Select **Grant admin consent for&#x20;*****your tenant name***.
3. Confirm the dialog.

Each permission should show **Granted for&#x20;*****tenant*** in the **Status** column.

{% hint style="info" %}
You need at least the **Cloud Application Administrator** role to grant consent.
{% endhint %}
{% endstep %}

{% step %}

### Create a client secret

1. In the app registration, go to **Certificates & secrets** → **Client secrets**.
2. Select **New client secret**.
3. Add a description and choose an expiration period.
4. Select **Add**.
5. Copy the secret **Value** immediately. Use it as the **Client Secret** in StackAI.
   {% endstep %}

{% step %}

### Add the connector in StackAI

1. Go to [**Settings** → **Connectors** → **Outlook**](https://www.stackai.com/settings/connectors/outlook).
2. Enter the **Client ID**, **Tenant ID**, and **Client Secret**.
3. Save the connector.

Users can now sign in with this connector. Authentication runs through your Entra app.
{% endstep %}
{% endstepper %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.stackai.com/workflow-builder/apps/outlook/set-up-a-custom-outlook-oauth-connector.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.