Runlayer Deploy Required: All Microsoft 365 servers require Runlayer Deploy to be enabled.
| Server | Description |
|---|---|
| Microsoft Outlook | Read, search, send emails, and manage drafts |
| Microsoft OneDrive | Browse, search, and manage files and folders |
| Microsoft SharePoint | Access sites, document libraries, lists, and list items |
Available Tools
Microsoft Outlook
| Tool | Description |
|---|---|
outlook_list_messages | List messages in a folder (inbox, sentitems, drafts, …), newest first |
outlook_list_folders | List top-level mail folders with counts |
outlook_get_message | Fetch one message by id (headers + body, text or html) |
outlook_search_messages | Full-text search via Graph $search (supports KQL-style operators) |
outlook_create_draft | Save a new draft (all fields optional) |
outlook_send_message | Send a new message immediately, optional save-to-sent |
outlook_send_draft | Send a previously-saved draft by id |
outlook_reply_message | Reply / reply-all to an existing message |
Microsoft OneDrive
| Tool | Description |
|---|---|
onedrive_list_items | List the immediate children of a folder (defaults to drive root) |
onedrive_get_item | Fetch metadata for a single file or folder by id |
onedrive_search_items | Full-text search across the caller’s OneDrive |
onedrive_list_shared_with_me | List items shared with the caller by other users |
onedrive_read_file | Download and return the text content of a file (≤ 5 MB) |
onedrive_create_folder | Create a new folder |
onedrive_upload_file | Create or overwrite a text file with provided content (≤ 5 MB) |
onedrive_rename_item | Rename a file or folder |
onedrive_move_item | Move a file or folder to a different folder |
onedrive_delete_item | Move a file or folder to the Recycle Bin |
onedrive_create_share_link | Generate a shareable view/edit/embed link for an item |
Microsoft SharePoint
| Tool | Description |
|---|---|
sharepoint_list_sites | List SharePoint sites the caller follows |
sharepoint_search_sites | Tenant-wide search for sites by name or description |
sharepoint_get_site | Fetch metadata for a single site by id or hostname/path |
sharepoint_list_drives | List document libraries (drives) in a site |
sharepoint_list_folder_items | Browse files and folders inside a document library |
sharepoint_read_file | Download and return the text content of a file in a document library (≤ 5 MB) |
sharepoint_list_lists | List SharePoint lists in a site |
sharepoint_list_list_items | List items in a SharePoint list, with optional field expansion |
sharepoint_get_list_item | Fetch a single list item by id, including all field values |
sharepoint_create_list_item | Create a new item in a SharePoint list |
sharepoint_update_list_item | Update fields on an existing list item |
sharepoint_delete_list_item | Delete an item from a SharePoint list |
Setup
Register a single-tenant Entra application
- Sign in to https://entra.microsoft.com as a user who can create app registrations
- Go to App registrations → New registration
- Name it (e.g. “Runlayer Microsoft 365 MCP”)
- Set Supported account types to Single tenant only
- Under Redirect URI, select Web and enter
https://<your-tenant>.runlayer.com/oauth/callback - Click Register
- Copy the Application (client) ID and Directory (tenant) ID — you’ll need both below
Set requestedAccessTokenVersion to 2
- In your app registration, open Manifest
- Find
"requestedAccessTokenVersion"and set it to2 - Click Save
Grant Microsoft Graph permissions
- Go to API permissions → Add a permission → Microsoft Graph → Delegated permissions
- Add the scopes for each server you want to use (see OAuth Scopes below)
- Click Grant admin consent for <your tenant> — requires a tenant admin; without this, users see a “Need admin approval” error at first sign-in
Create a client secret
- Go to Certificates & secrets → New client secret
- Add a description and expiry, then click Add
- Copy the Value immediately — it won’t be shown again
Add connectors in Runlayer
For each Microsoft 365 server you want to use:
- In Runlayer, go to My connectors and click + Add connector
- Search for the server (e.g. Microsoft Outlook) and click its card
- Click + Create New
- Enter:
- MICROSOFT_OAUTH_CLIENT_ID — the Application (client) ID from Entra
- MICROSOFT_OAUTH_CLIENT_SECRET — the client secret value you copied
- MICROSOFT_OAUTH_TENANT — the Directory (tenant) ID from Entra
- Click Deploy Server and wait for deployment to complete (typically a few minutes)
- When the button changes to Go to Connector, click it
OAuth Scopes
Add these scopes when configuring delegated permissions on your Entra app registration. Only add the scopes for the servers you intend to deploy — and only go as far down the read/write split as your use case requires.| Server | Scope | Required for |
|---|---|---|
| All | openid | Sign-in |
| All | profile | User profile |
| All | offline_access | Refresh tokens for persistent access |
| All | User.Read | Identity resolution via Graph /me |
| Outlook | Mail.ReadWrite | Reading messages, listing folders, searching, and creating drafts (Mail.ReadWrite is a superset of Mail.Read) |
| Outlook | Mail.Send | Sending messages and sending saved drafts |
| OneDrive (read) | Files.Read.All | Listing items, getting metadata, searching, reading file content, listing shared-with-me |
| OneDrive (write) | Files.ReadWrite.All | Creating folders, uploading files, renaming, moving, deleting, creating share links (superset of Files.Read.All) |
| SharePoint (read) | Sites.Read.All | Listing and searching sites, browsing document libraries, reading list items and file content |
| SharePoint (write) | Sites.ReadWrite.All | Creating, updating, and deleting list items (superset of Sites.Read.All) |
Troubleshooting
Need admin approval
Need admin approval
Enterprise Entra tenants typically disable user consent. A tenant admin must click Grant admin consent for <tenant> on the app registration’s API permissions page before users can authorize.
Invalid redirect_uri
Invalid redirect_uri
The redirect URI in the authorization request doesn’t match any registered URI. Confirm
https://<your-tenant>.runlayer.com/oauth/callback is listed under Authentication → Redirect URIs in your app registration.Access is denied (Graph 403)
Access is denied (Graph 403)
Token was issued before a required permission was added. In Runlayer, go to the connector’s Settings, revoke access, then Connect again to re-consent.
Invalid grant
Invalid grant
Tokens may have expired. Disconnect and reconnect the server in Runlayer.
sharepoint_list_sites returns empty
sharepoint_list_sites returns empty