Set up a custom Outlook OAuth connector
Create a Microsoft Entra app for a single-tenant or restricted-scope OAuth connection.
Last updated
Was this helpful?
Create a Microsoft Entra app for a single-tenant or restricted-scope OAuth connection.
Create a custom OAuth connector when authentication must run through your Microsoft Entra app. This applies to single-tenant and on-premises deployments. It also applies when you must restrict the requested scopes.
You'll register an app in Microsoft Entra ID, grant delegated Microsoft Graph permissions, create a client secret, and add those credentials to StackAI.
Sign in to the Microsoft Entra admin center or Azure portal.
Go to Identity → Applications → App registrations.
Select New registration.
Complete the form:
Name: Use a descriptive name, such as StackAI Outlook OAuth2 Connector.
Supported account types: Select Single tenant.
Redirect URI: Select Web. Enter https://www.stackai.com/auth.
For single-tenant and on-premises deployments, the redirect URI is instance-specific. StackAI displays the correct URI when you create the connector.
Select Register.
On the app's Overview page, copy these values:
Application (client) ID: Use this as the Client ID in StackAI.
Directory (tenant) ID: Use this as the Tenant ID in StackAI.
A custom OAuth2 connector uses delegated Microsoft Graph permissions. The app acts on behalf of the signed-in user.
User.Read
Delegated
Read the signed-in user's profile for health checks via /me.
Mail.Read
Delegated
Read emails for the Search Emails action.
Mail.ReadWrite
Delegated
Create drafts, add attachments, modify messages, and reply or forward.
Mail.Send
Delegated
Send emails as the signed-in user.
MailboxSettings.Read
Delegated
Get the list of email categories.
Calendars.ReadWrite
Delegated
Read calendars and create events.
offline_access
Delegated
Obtain refresh tokens.
openid
Delegated
OpenID Connect sign-in.
profile
Delegated
Read basic profile information.
email
Delegated
Read the user's email address.
Confirm the scopes for your intended actions in Outlook connector settings.
In the app registration, go to API permissions → Add a permission.
Select Microsoft Graph.
Select Delegated permissions.
Select each required permission from the table.
Select Add permissions.
Pre-authorize high-privilege permissions for your tenant. This avoids individual consent prompts and tenant policy blocks.
In the app registration, go to API permissions.
Select Grant admin consent for your tenant name.
Confirm the dialog.
Each permission should show Granted for tenant in the Status column.
You need at least the Cloud Application Administrator role to grant consent.
Last updated
Was this helpful?
Was this helpful?

