Skip to main content
Built by Runlayer. Runlayer builds and maintains this connector. It runs on Runlayer Deploy, which must be enabled for your workspace.
Microsoft 365 vs. Microsoft Agent 365 — This page covers Runlayer’s first-party MCP servers built on Microsoft Graph: you register your own single-tenant Entra app, giving you granular control over scopes and tools. If you’d rather skip the app registration, or you need Word or Copilot Search, use Microsoft Agent 365 instead — Microsoft’s hosted “Work IQ” servers with near-zero setup.
Runlayer Deploy Required: All Microsoft 365 servers require Runlayer Deploy to be enabled.
Connect your AI assistant to Microsoft 365 services. All Microsoft 365 servers share the same Entra app registration setup process.

​
Available Tools

​
Microsoft Outlook

​
Microsoft Outlook Calendar

​
Microsoft OneDrive

​
Microsoft SharePoint

​
Microsoft Teams

​
Setup

1

Register a single-tenant Entra application

  1. Sign in to https://entra.microsoft.com as a user who can create app registrations
  2. Go to App registrations → New registration
  3. Name it (e.g. “Runlayer Microsoft 365 MCP”)
  4. Set Supported account types to Single tenant only
  5. Under Redirect URI, select Web and enter https://<your-tenant>.runlayer.com/oauth/callback
  6. Click Register
  7. Copy the Application (client) ID and Directory (tenant) ID — you’ll need both below
2

Set requestedAccessTokenVersion to 2

  1. In your app registration, open Manifest
  2. Find "requestedAccessTokenVersion" and set it to 2
  3. Click Save
3

Grant Microsoft Graph permissions

  1. Go to API permissions → Add a permission → Microsoft Graph → Delegated permissions
  2. Add the scopes for each server you want to use (see OAuth Scopes below)
  3. Click Grant admin consent for <your tenant> — requires a tenant admin; without this, users see a “Need admin approval” error at first sign-in
4

Create a client secret

  1. Go to Certificates & secrets → New client secret
  2. Add a description and expiry, then click Add
  3. Copy the Value immediately — it won’t be shown again
5

Add connectors in Runlayer

For each Microsoft 365 server you want to use:
  1. In Runlayer, go to My connectors and click + Add connector
  2. Search for the server (e.g. Microsoft Outlook) and click its card
  3. Click + Create New
  4. Enter:
    • MICROSOFT_OAUTH_CLIENT_ID — the Application (client) ID from Entra
    • MICROSOFT_OAUTH_CLIENT_SECRET — the client secret value you copied
    • MICROSOFT_OAUTH_TENANT — the Directory (tenant) ID from Entra
  5. Click Deploy Server and wait for deployment to complete (typically a few minutes)
  6. When the button changes to Go to Connector, click it
6

Authorize

  1. Click Connect on the connector page
  2. Sign in with a Microsoft account that exists in your Entra tenant and grant permissions

​
OAuth Scopes

Add these scopes when configuring delegated permissions on your Entra app registration. Only add the scopes for the servers you intend to deploy — and only go as far down the read/write split as your use case requires.

​
Troubleshooting

Enterprise Entra tenants typically disable user consent. A tenant admin must click Grant admin consent for <tenant> on the app registration’s API permissions page before users can authorize.
The redirect URI in the authorization request doesn’t match any registered URI. Confirm https://<your-tenant>.runlayer.com/oauth/callback is listed under Authentication → Redirect URIs in your app registration.
Token was issued before a required permission was added. In Runlayer, go to the connector’s Settings, revoke access, then Connect again to re-consent.
Tokens may have expired. Disconnect and reconnect the server in Runlayer.
sharepoint_list_sites returns sites the user explicitly follows in SharePoint. If the list is empty, use sharepoint_search_sites to discover sites; it accepts an exact site name (including hyphenated names), a full site URL, a server-relative path, or a fuzzy phrase, and surfaces exact matches first. You can also navigate to a site in the browser and follow it first.