Skip to main content
Runlayer Deploy Required: The Outlook server requires Runlayer Deploy to be enabled.
Connect your AI assistant to Microsoft Outlook via the Microsoft Graph API. Tools run on your Runlayer deployment with OAuth-stored per-user tokens; the assistant never sees Microsoft tokens directly.

​
Available Tools

ToolDescription
outlook_list_messagesList messages in a folder (inbox, sentitems, drafts, …), newest first
outlook_list_foldersList top-level mail folders with counts
outlook_get_messageFetch one message by id (headers + body, text or html)
outlook_search_messagesFull-text search via Graph $search (supports KQL-style operators)
outlook_create_draftSave a new draft (all fields optional)
outlook_send_messageSend a new message immediately, optional save-to-sent
outlook_send_draftSend a previously-saved draft by id
outlook_reply_messageReply / reply-all to an existing message

​
Setup

1

Register a single-tenant Entra application

  1. Sign in to https://entra.microsoft.com as a user who can create app registrations
  2. Go to App registrations → New registration
  3. Name it (e.g. “Runlayer Outlook MCP”)
  4. Set Supported account types to Single tenant only
  5. Under Redirect URI, select Web and enter https://<your-tenant>.runlayer.com/oauth/callback
  6. Click Register
  7. Copy the Application (client) ID and Directory (tenant) ID — you’ll need both below
2

Set requestedAccessTokenVersion to 2

  1. In your app registration, open Manifest
  2. Find "requestedAccessTokenVersion" and set it to 2
  3. Click Save
3

Grant Microsoft Graph permissions

  1. Go to API permissions → Add a permission → Microsoft Graph → Delegated permissions
  2. Add: openid, profile, offline_access, User.Read, Mail.ReadWrite, Mail.Send
  3. Click Grant admin consent for <your tenant> — requires a tenant admin; without this, users see a “Need admin approval” error at first sign-in
4

Create a client secret

  1. Go to Certificates & secrets → New client secret
  2. Add a description and expiry, then click Add
  3. Copy the Value immediately — it won’t be shown again
5

Add Server in Runlayer

  1. In Runlayer, go to My connectors, select Outlook, and click Add connector
  2. Check Custom OAuth credentials
  3. Enter your Client ID (Application ID), Client Secret, and Tenant ID (Directory ID)
  4. Click Deploy Server
6

Authorize

  1. Click Connect on the server page
  2. Sign in with your Microsoft account and grant permissions

​
OAuth Scopes

ScopeDescription
openidSign-in
profileUser profile
offline_accessRefresh tokens for persistent access
User.ReadIdentity resolution via Graph /me
Mail.ReadWriteRead messages and create drafts (Mail.ReadWrite is a superset of Mail.Read)
Mail.SendSend mail and send drafts

​
Troubleshooting

Enterprise Entra tenants typically disable user consent. A tenant admin must click Grant admin consent for <tenant> on the app registration’s API permissions page before users can authorize.
The redirect URI in the authorization request doesn’t match any registered URI. Confirm https://<your-tenant>.runlayer.com/oauth/callback is listed under Authentication → Redirect URIs in your app registration.
Token was issued before a required permission was added. In Runlayer, go to the connector’s Settings, revoke access, then Connect again to re-consent.
Tokens may have expired. Disconnect and reconnect the server in Runlayer.