Outlook

Email management for Microsoft 365

Connect your agent to Outlook to read and search your Microsoft 365 emails and create drafts.

How to enable

1. Enable the capability

   Go to Settings → Capabilities and enable Outlook.

2. Connect your Microsoft account

   Click Create new to sign in with your Microsoft account and create a personal access token. This token belongs to you and can be managed in your profile settings.

   If you already have an Outlook token from setting up another agent, you can select it from the dropdown instead.

In many organizations, a Microsoft admin must approve the Abundly Outlook app before the connection can be completed. If you see an “Almost There” message after sign-in, ask your admin to grant approval in Microsoft Entra, then try connecting again.

Sending behavior

By default, Outlook gives your agent read and draft tools only.

In capability settings, you can enable Allow sending email to let the agent send immediately from your Outlook mailbox.

Sending is a sensitive action. When Allow sending email is on, your agent can send messages directly instead of only drafting them.

Technical details

This section describes exactly what the integration requests and how access is scoped. Useful when a Microsoft admin needs to review the app before granting consent.

What the agent connects to

Outlook runs against Microsoft Graph (graph.microsoft.com/v1.0) using delegated OAuth 2.0 through the Microsoft identity platform. The integration is registered as a multitenant app against the organizations endpoint, so work and school accounts are supported and personal Microsoft accounts are not.

Everything the agent does goes through the /me endpoints of the connected account. The agent cannot reach another user’s mailbox, a shared mailbox it wasn’t granted, or any mailbox outside the connected account.

Permissions requested

Scope	Why it’s requested
openid, profile, email	Sign-in and identifying which account was connected
offline_access	A refresh token, so the agent keeps working without re-authorizing
User.Read	Reads the account’s email address to label the connection
Mail.Read	Lists and reads messages
Mail.ReadWrite	Creates drafts
Mail.Send	Only requested when Allow sending email is enabled at the moment you connect

All permissions are delegated — the agent acts as the connected user and can never do more in Outlook than that user can.

Tools exposed to the agent

Tool	What it does	Available
list_outlook_messages	Lists messages in a folder (Inbox by default), max 50 per call, optional search query	Always
get_outlook_message	Reads one message by ID, including the full body	Always
create_outlook_draft	Creates a draft — never sends it	Always
send_outlook_mail	Sends immediately from the mailbox and saves to Sent Items	Only when Allow sending email is on

Sending is gated twice

send_outlook_mail is off by default and requires two independent things to be true:

1. Allow sending email is enabled in the capability settings.
2. The connected token actually holds Mail.Send — which it only does if the toggle was already on when you authorized.

Turning the toggle on for an existing connection is therefore not enough on its own. The capability card detects a token without send permission and prompts you to reconnect, which triggers a fresh consent screen listing the send permission.

Tokens and access

• The connection is stored as a personal token that belongs to you, not to the workspace or the agent. Manage it under Profile settings → Personal Tokens, where you can see which agents use it and disconnect it.
• Access tokens are refreshed automatically shortly before they expire, using the refresh token from offline_access. See Credentials for how Abundly handles credentials generally.
• The agent never sees the token. Authentication is attached when the platform calls Microsoft Graph, after the model has decided what to do.
• Every Outlook tool call is recorded in the agent’s activity log.

An agent using your token acts as you in Outlook, and anyone who can use that agent can use its Outlook access. Only connect your mailbox to agents whose access list you’re comfortable with, and leave sending off unless the agent genuinely needs it.

Admin-side controls

Your Microsoft admins keep full control independently of Abundly:

• Admin consent — many tenants require an admin to approve “Abundly Outlook Integration” in Microsoft Entra before any user can connect.
• Conditional Access — your existing policies apply to the delegated token.
• Revocation — removing the enterprise application in Entra, or revoking the user’s sessions, cuts off every agent using it immediately.

Example use cases

• Email Summary — “Summarize all emails from my manager this week”
• Attachment Search — “Find emails with invoice attachments from the last month and add them to my Notion tracker”
• Daily Digest — “Every morning at 8am, check my inbox for urgent emails and post a summary to Slack”
• SMS Follow-up — “When a team member sends an SMS to you about a deal, find their recent emails and draft a follow-up”