Set up a custom Outlook OAuth connector

Create a Microsoft Entra app for a single-tenant or restricted-scope OAuth connection.

Create a custom OAuth connector when authentication must run through your Microsoft Entra app. This applies to single-tenant and on-premises deployments. It also applies when you must restrict the requested scopes.

You'll register an app in Microsoft Entra ID, grant delegated Microsoft Graph permissions, create a client secret, and add those credentials to StackAI.

1

Register an app in Microsoft Entra ID

1. Sign in to the Microsoft Entra admin center or Azure portal.

2. Go to Identity → Applications → App registrations.

3. Select New registration.

4. Complete the form:

   • Name: Use a descriptive name, such as StackAI Outlook OAuth2 Connector.

   • Supported account types: Select Single tenant.

   • Redirect URI: Select Web. Enter https://www.stackai.com/auth.

For single-tenant and on-premises deployments, the redirect URI is instance-specific. StackAI displays the correct URI when you create the connector.

1. Select Register.

2. On the app's Overview page, copy these values:

   • Application (client) ID: Use this as the Client ID in StackAI.

   • Directory (tenant) ID: Use this as the Tenant ID in StackAI.

2

Add Microsoft Graph API permissions

A custom OAuth2 connector uses delegated Microsoft Graph permissions. The app acts on behalf of the signed-in user.

Permission	Type	Purpose
User.Read	Delegated	Read the signed-in user's profile for health checks via /me.
Mail.Read	Delegated	Read emails for the Search Emails action.
Mail.ReadWrite	Delegated	Create drafts, add attachments, modify messages, and reply or forward.
Mail.Send	Delegated	Send emails as the signed-in user.
MailboxSettings.Read	Delegated	Get the list of email categories.
Calendars.ReadWrite	Delegated	Read calendars and create events.
offline_access	Delegated	Obtain refresh tokens.
openid	Delegated	OpenID Connect sign-in.
profile	Delegated	Read basic profile information.
email	Delegated	Read the user's email address.

Confirm the scopes for your intended actions in Outlook connector settings.

1. In the app registration, go to API permissions → Add a permission.

2. Select Microsoft Graph.

3. Select Delegated permissions.

4. Select each required permission from the table.

5. Select Add permissions.

3

Grant admin consent

Pre-authorize high-privilege permissions for your tenant. This avoids individual consent prompts and tenant policy blocks.

1. In the app registration, go to API permissions.

2. Select Grant admin consent for your tenant name.

3. Confirm the dialog.

Each permission should show Granted for tenant in the Status column.

You need at least the Cloud Application Administrator role to grant consent.

4

Create a client secret

1. In the app registration, go to Certificates & secrets → Client secrets.

2. Select New client secret.

3. Add a description and choose an expiration period.

4. Select Add.

5. Copy the secret Value immediately. Use it as the Client Secret in StackAI.

5

Add the connector in StackAI

1. Go to Settings → Connectors → Outlook.

2. Enter the Client ID, Tenant ID, and Client Secret.

3. Save the connector.

Users can now sign in with this connector. Authentication runs through your Entra app.