> For the complete documentation index, see [llms.txt](https://docs.stackai.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stackai.com/workflow-builder/apps/outlook/set-up-an-outlook-app-registration.md).

# Set up an Outlook app registration

Use an app registration when a workflow needs app-only mailbox access. No user signs in. This is useful for shared or service mailboxes and the **On Email Received** trigger.

### Before you begin

Create a Microsoft Entra app registration. Create a client secret. Copy its **Client ID**, **Tenant ID**, and **Client Secret**.

For app-only access, configure **Application** permissions. Do not use delegated permissions.

{% stepper %}
{% step %}

### Add Microsoft Graph permissions

In your Microsoft Entra app registration, go to **API permissions** → **Add a permission** → **Microsoft Graph** → **Application permissions**.

Add the permissions required by your workflow:

<table><thead><tr><th width="230">Permission</th><th width="150">Type</th><th>Purpose</th></tr></thead><tbody><tr><td><code>Mail.Send</code></td><td>Application</td><td>Send emails as any user.</td></tr><tr><td><code>Mail.Read</code></td><td>Application</td><td>Read emails for the Search Emails action.</td></tr><tr><td><code>Mail.ReadBasic.All</code></td><td>Application</td><td>Required for the On Email Received trigger.</td></tr><tr><td><code>Mail.ReadWrite</code></td><td>Application</td><td>Create drafts, add attachments, modify messages, and reply or forward.</td></tr><tr><td><code>MailboxSettings.Read</code></td><td>Application</td><td>Get the list of email categories.</td></tr><tr><td><code>Calendars.ReadWrite</code></td><td>Application</td><td>Read calendars and create events.</td></tr><tr><td><code>User.Read.All</code></td><td>Application</td><td>Read user profiles. Optional.</td></tr></tbody></table>

Grant admin consent for your tenant after adding permissions.
{% endstep %}

{% step %}

### Create a mailbox boundary

By default, app-only permissions grant access to all tenant mailboxes. Complete this step and the next one to limit access.

1. In the **Microsoft 365 Admin Center**, go to **Teams & groups** → **Shared mailboxes**.
2. Create the shared mailbox for the workflow.
3. Go to **Active teams & groups** → **Mail-enabled security**.
4. Create a mail-enabled security group, such as `StackAI-Authorized-Mailboxes`.
5. Add the shared mailbox to that group.
   {% endstep %}

{% step %}

### Restrict mailbox access

An administrator must complete these steps in PowerShell.

1. Connect to Exchange Online.

   ```powershell
   Connect-ExchangeOnline
   ```
2. Create the access policy. Replace the values with your app's client ID and security-group email.

   ```powershell
   New-ApplicationAccessPolicy -AppId "YOUR_CLIENT_ID" `
       -PolicyScopeGroupId "stackai-access@yourdomain.com" `
       -AccessRight RestrictAccess `
       -Description "Allow Stack AI to access authorized mailboxes only."
   ```
3. Wait 15 minutes. Then verify access.

   ```powershell
   Test-ApplicationAccessPolicy -Identity "yourmailbox@yourdomain.com" -AppId "YOUR_CLIENT_ID"
   ```

The command must return `AccessCheckResult: Granted`.
{% endstep %}

{% step %}

### Create the StackAI connection

1. Create an **Outlook (App Registration)** connection.
2. Enter the **Client ID**, **Client Secret**, and **Tenant ID**.
3. Enter the shared mailbox address as the **User Principal Name**.
4. For **On Email Received**, select this connection and set **Folder** to `Inbox`.
   {% endstep %}
   {% endstepper %}

{% hint style="warning" %}
A `403 Forbidden` error can mean admin consent is missing. It can also mean the access policy has not synced. Exchange changes can take 30–60 minutes.

A `404 Not Found` error can mean the **User Principal Name** is incorrect. Run `Get-User -Identity "email"` to confirm the exact UPN.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.stackai.com/workflow-builder/apps/outlook/set-up-an-outlook-app-registration.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.