> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Microsoft Outlook with OAuth 2.0 (Client Credentials) – StackOne Hub

> Link a Microsoft Outlook account in the StackOne Hub using OAuth 2.0 (Client Credentials). End-user guide to authorize the integration and start using Microsoft Outlook actions.

> [!WARNING]
>
> You must have at least Application Developer permissions to register the app, and a Global Administrator or Privileged Role Administrator must grant admin consent. Client credentials cannot call /me endpoints, so pass the mailbox owner's ID or userPrincipalName in the userId input of every action. Webhook events are not supported with this authentication type.

Select Actions to adjust the guideSome actions may require additional configuration in the provider to be accessible. Choose the actions you need and the guide will be updated.

Select all
Clear

ActionScope(s)

Loading actions...No actions match your search.

Dynamic Guide URL

Copy URL

Scopes Selected

<pre role="textbox" aria-readonly="true" tabIndex="0" />

Separator

Copy scopes

## Register Your Application in Microsoft Entra ID

To use client credentials with Microsoft Outlook, register an application in Microsoft Entra ID and grant it Microsoft Graph application permissions.

**1. Sign in to Microsoft Entra Admin Center**

Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an Application Developer. If you have access to multiple tenants, click the **Settings** (gear) icon in the top-right corner, then select the desired tenant from the list under **Directory + subscription**.

**2. Create a New App Registration**

Navigate to **App registrations** by searching from the top search bar and click on **New registration**.

<ul>
  <li>Enter a meaningful **Name** for your app (e.g., StackOne Microsoft Outlook App-Only).</li>
  <li>Under **Supported account types**, select **Single tenant**.</li>
  <li>Leave the **Redirect URI** blank; client credentials does not use a redirect.</li>
  <li>Click **Register** to create the app registration.</li>
</ul>

**3. Copy the Application (Client) ID and Directory (Tenant) ID**

On the application's **Overview** page, copy the **Application (client) ID** and the **Directory (tenant) ID** values and store them securely for use later.

## Configure Application Permissions

Grant your application Microsoft Graph application permissions. These apply without a signed-in user and always need admin consent.

**1. Open API Permissions**

From the left menu under **Manage**, select **API permissions**.

**2. Add Microsoft Graph Application Permissions**

Enables actions: Add Attachment, Copy Mail Folder, Copy Message, Create Child Folder, Create Draft Message, Create Draft Reply All To Message, Create Draft Reply To Message, Create Draft To Forward Message, Create Mail Folder, Create Message In Mail Folder, Create Message Rule, Delete Attachment, Delete Mail Folder, Delete Message, Delete Message Rule, Forward Message, Get Attachment, Get Mail Folder, Get Mail Folder Delta, Get Message, Get Message Delta From Folder, Get Message Rule, List Attachments, List Child Folders, List Folder Messages, List Mail Folders, List Message Rules, List Messages, Move Mail Folder, Move Message, Permanently Delete Mail Folder, Permanently Delete Message, Reply All To Message, Reply To Message, Send Draft Message, Send Mail, Update Mail Folder, Update Message, Update Message Rule

Click **Add a permission**, select **Microsoft Graph**, then select **Application permissions**. Delegated permissions with the same names are ignored by client credentials, so each permission must show **Application** in the **Type** column.

<ul>
  <li>Search for `Mail` and `MailboxSettings`, click **expand all**, and select the permissions your integration needs.</li>
  <li>For full mail access: `Mail.ReadWrite` (Read and write mail in all mailboxes)</li>
  <li>For sending mail: `Mail.Send` (Send mail as any user)</li>
  <li>For message rules and mailbox settings: `MailboxSettings.ReadWrite` (Read and write all user mailbox settings)</li>
  <li>Click **Add permissions** to save.</li>
</ul>

<ul>
  <li>
    Mail.ReadBasic
  </li>

  <li>
    Mail.Read
  </li>

  <li>
    Mail.ReadWrite
  </li>

  <li>
    Mail.Send
  </li>

  <li>
    MailboxSettings.Read
  </li>

  <li>
    MailboxSettings.ReadWrite
  </li>
</ul>

**3. Grant Admin Consent**

Click **Grant admin consent for \[Your Organization]** and select **Yes**. Verify that **Granted for \[Your Organization]** appears under the **Status** column for each permission. If you add or change permissions after connecting the account in StackOne, reconnect the account so it requests a new access token that includes them.

**4. Limit Mailbox Access (Optional)**

By default the app can access every mailbox in the tenant. To restrict it to specific mailboxes, an Exchange administrator can use [Role Based Access Control for Applications in Exchange Online](https://learn.microsoft.com/en-us/exchange/permissions-exo/application-rbac). Changes can take 30 minutes to 2 hours to apply.

## Generate Client Secret

Create a client secret that StackOne uses to request access tokens.

**1. Navigate to Certificates & Secrets**

From the left menu under **Manage**, select **Certificates & secrets**.

**2. Create a New Client Secret**

Under the **Client secrets** tab, click **New client secret**, add a **Description**, select an expiration period and click **Add**.

**3. Copy the Client Secret Value**

Immediately copy the **Value** of the newly created client secret and store it securely. This value will only be shown once and cannot be retrieved again.

## Link the Account

**1. Connect**

<ul>
  <li>Click **Connect**.</li>
  <li>If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider's authorization flow.</li>
  <li>Once authorization is successful, you will see a confirmation popup.</li>
</ul>

**2. Use Actions**

Connect an AI platform to the linked account's actions. See [AI Platforms](https://docs.stackone.com/connect/ai-platforms/overview.md).

Other ways to call actions are listed in [Protocols & SDKs](https://docs.stackone.com/connect/protocols-and-sdks.md).

## Next Steps

> [card] [Webhooks setup](https://docs.stackone.com/connectors/microsoftoutlook/guides/webhook-setup.md)
>
> Configure receiving Events for Microsoft Outlook into StackOne.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.