Outlook Mail setup guide

Agents read conversations and write messages for your company. Anything a customer or the public sees, such as a sent email or a posted message, is tier 3, so it asks first unless you decide otherwise.

Ways to connect

Company admins connect apps, on the Integrations page in Everdeck: open Outlook Mail, choose one of the ways below, follow its steps and fill in its fields. Everdeck checks what you enter before it saves anything, and asks you to confirm it’s you (your second factor) before you type any secret. How connecting works.

Your Microsoft Entra app registration

Your OAuth app.

This way signs in with an OAuth app you create for Outlook Mail, as its steps describe: Everdeck never uses an app of its own. Register this redirect URI with your app:

https://everdeck.io/api/oauth/callback

Then save the app’s client ID and secret in Everdeck, on the connect page or under OAuth apps, and sign in.

1. Open https://entra.microsoft.com and go to Entra ID > App registrations > New registration. Name it, for example "Everdeck mail".
2. Under Supported account types choose "Single tenant only", and add a Web redirect URI: https://everdeck.io/api/oauth/callback. For a personal Outlook.com mailbox, choose "Any Entra ID Tenant + Personal Microsoft accounts" (or "Personal accounts only") and enter consumers as the tenant ID.
3. Under API permissions, add Microsoft Graph delegated permissions offline_access, User.Read, Mail.ReadWrite and Mail.Send. If your organization blocks user consent, click "Grant admin consent".
4. Under Certificates & secrets, create a client secret and copy its Value (shown once).
5. From the Overview page, copy the Application (client) ID and the Directory (tenant) ID into the form, click Connect, and sign in as the mailbox the agent should use.

Field	What to enter
Directory (tenant) ID	Text. For example 00000000-0000-0000-0000-000000000000, or consumers for Outlook.com.

The scopes Everdeck asks for:

• offline_access
• User.Read
• Mail.ReadWrite
• Mail.Send

Disconnecting deletes the tokens Everdeck saved. Remove Everdeck at https://myapps.microsoft.com (work or school accounts) or https://account.live.com/consent/Manage (personal accounts).

What agents can do

An agent uses an action only when its charter grants it, on the agent’s Tools tab, where you choose whether each one runs by itself (Auto), asks first or never runs. Each action has a risk tier: tier 3 actions, which customers or the public see, ask first unless you choose otherwise, and tier 4 actions (money, deleting things, access) always need a person. How tools and tiers work.

Actions marked Reads outside content return things people outside your company may have written. Agents treat what they read as information, never as instructions, and their riskier actions later in the same session need approval.

• List email in a folderTier 0 · ReadReads outside contentoutlook_mail_list_messages

  Newest first. folder is a well-known name (inbox, archive, sentitems, drafts, deleteditems, junkemail) or a folder id from list_mail_folders. Optional OData filter; when filtering, put receivedDateTime first, for example "receivedDateTime ge 2026-10-01T00:00:00Z and isRead eq false".

• Search emailTier 0 · ReadReads outside contentoutlook_mail_search_messages

  Search the whole mailbox with KQL, for example from:alex subject:invoice, or participants:ana hasAttachments:true. Up to 1,000 results, newest first. Write the query without double quotes; the connector adds them.

• Read an emailTier 0 · ReadReads outside contentoutlook_mail_get_message

  Read one message with its plain-text body, recipients, categories, flag and attachment list (id, name, type, size).

• Download an attachmentTier 0 · ReadReads outside contentoutlook_mail_get_attachment

  Save a file attachment to the company's files and return the file reference.

• List mail foldersTier 0 · ReadReads outside contentoutlook_mail_list_mail_folders

  List top-level mail folders with ids and unread counts.

• Send an emailTier 3 · ExternalReads outside contentoutlook_mail_send_mail

  Send a new email and save it to Sent Items. Recipients are objects like {"emailAddress": {"address": "[email protected]", "name": "Ana"}}.

• Reply to an emailTier 3 · ExternalReads outside contentoutlook_mail_reply_to_message

  Reply in the same conversation and save to Sent Items. reply answers the sender (or Reply-To); replyAll also copies everyone on the original.

• Forward an emailTier 3 · ExternalReads outside contentoutlook_mail_forward_message

  Forward a message with a short note to one or more recipients.

• Draft an emailTier 2 · ReversibleReads outside contentoutlook_mail_create_draft

  Save a new draft in Drafts for a person to review and send. Returns the draft id and webLink.

• Draft a replyTier 2 · ReversibleReads outside contentoutlook_mail_create_reply_draft

  Save a reply (or reply-all) draft in the thread for a person to review and send.

• Mark, flag or categorize an emailTier 2 · ReversibleReads outside contentoutlook_mail_update_message

  Change read state, categories, flag or importance, for example {"isRead": true} or {"flag": {"flagStatus": "flagged"}, "categories": ["Invoices"]}.

• Move or archive an emailTier 2 · ReversibleReads outside contentoutlook_mail_move_message

  Move a message to a folder: archive, inbox, junkemail, or a folder id from list_mail_folders. Deleting email (moving it to Deleted Items) is not part of this connector. The moved message gets a new id, returned in the result.

Testing, problems and disconnecting

Everdeck checks the connection when you save it. On the connection’s page in Integrations, Test checks it again at any time.

If Outlook Mail later refuses the connection, for example because a key was deleted or a sign-in expired, the connection shows Needs attention on the Integrations page and the people who manage connections are told. Agents can’t use it until a company admin fixes it with Edit or Reconnect.

To stop agents using Outlook Mail, open the connection and select Disconnect. Agents stop using it at once and its saved credentials are deleted. What else happens depends on how it was connected: each way above says.