Skip to main content

​
Overview

CrewAI supports integration with Microsoft 365 applications including Outlook (email and calendar), OneDrive, Teams, SharePoint, Excel, and Word. This guide walks you through setting up OAuth credentials in Microsoft Entra ID (formerly Azure Active Directory) to enable these integrations.

​
Prerequisites

  • An Azure account with access to Microsoft Entra ID
  • Permissions to create app registrations in your Azure tenant
  • Admin consent capability for granting API permissions (may require Azure AD admin)

​
Azure App Registration Setup

​
Step 1: Navigate to App Registrations

  1. Sign in to the Azure Portal
  2. Search for and select Microsoft Entra ID (or Azure Active Directory)
  3. In the left sidebar, click App registrations
  4. Click New registration

​
Step 2: Register Your Application

  1. Name: Enter a name for your application (e.g., “CrewAI Integration”)
  2. Supported account types: Select the appropriate option:
OptionDescriptionUse Case
Single tenantOnly accounts in your organizationEnterprise deployment with internal users only
MultitenantAccounts in any organizational directoryEnterprise deployment with external collaborators
Multitenant + personalAny organizational or personal Microsoft accountsBroadest access including personal accounts
For most enterprise deployments, select Accounts in this organizational directory only (single tenant) for better security control.
  1. Redirect URI:
    • Select Web as the platform
    • Add redirect URIs for each Microsoft integration you want to enable: 
      https://<YOUR_APPLICATION_HOST>/oauthsvc/oauth/microsoft_outlook/callback
https://<YOUR_APPLICATION_HOST>/oauthsvc/oauth/microsoft_onedrive/callback
https://<YOUR_APPLICATION_HOST>/oauthsvc/oauth/microsoft_teams/callback
https://<YOUR_APPLICATION_HOST>/oauthsvc/oauth/microsoft_sharepoint/callback
https://<YOUR_APPLICATION_HOST>/oauthsvc/oauth/microsoft_excel/callback
https://<YOUR_APPLICATION_HOST>/oauthsvc/oauth/microsoft_word/callback
    • Replace <YOUR_APPLICATION_HOST> with your CrewAI application domain
  2. Click Register

​
Step 3: Note Your Application Credentials

After registration, you’ll be taken to the app’s overview page. Note the following values:
  • Application (client) ID: This is your Client ID
  • Directory (tenant) ID: Your Azure AD tenant ID

​
Configure API Permissions

​
Step 1: Add Microsoft Graph Permissions

  1. In your app registration, click API permissions in the left sidebar
  2. Click Add a permission
  3. Select Microsoft Graph
  4. Select Delegated permissions
  5. Add the permissions required for your integrations (see Required Scopes below)
  6. Click Add permissions
Some permissions require admin consent. If you have admin privileges:
  1. Click Grant admin consent for [Your Organization]
  2. Click Yes to confirm
If you don’t have admin privileges, you’ll need to request consent from your Azure AD administrator. Without admin consent, some integrations may not work properly.

​
Create Client Secret

​
Step 1: Generate a New Secret

  1. In your app registration, click Certificates & secrets in the left sidebar
  2. Under Client secrets, click New client secret
  3. Enter a description (e.g., “CrewAI Production”)
  4. Select an expiration period:
    • 6 months - More secure, requires regular rotation
    • 12 months - Balance of security and convenience
    • 24 months - Less maintenance, but less secure
  5. Click Add

​
Step 2: Save the Secret Value

Important: Copy the secret Value immediately. It will only be shown once. If you navigate away without copying it, you’ll need to create a new secret.
Store the Client ID and Client Secret securely for CrewAI configuration.

​
Required Scopes per Integration

The following permissions should be added to your app registration. All integrations require the base permissions, plus integration-specific permissions.

​
Base Permissions (Required for All)

PermissionTypeDescription
offline_accessDelegatedMaintain access to data (refresh tokens)
openidDelegatedSign users in
profileDelegatedView users’ basic profile
User.ReadDelegatedSign in and read user profile

​
Microsoft Outlook (Email)

PermissionTypeDescription
Mail.ReadDelegatedRead user mail
Mail.ReadWriteDelegatedRead and write user mail
Mail.SendDelegatedSend mail as the user

​
Microsoft Outlook (Calendar)

PermissionTypeDescription
Calendars.ReadDelegatedRead user calendars
Calendars.ReadWriteDelegatedRead and write user calendars

​
Microsoft OneDrive

PermissionTypeDescription
Files.ReadDelegatedRead user files
Files.ReadWriteDelegatedRead and write user files
Files.ReadWrite.AllDelegatedFull access to all files user can access

​
Microsoft Teams

PermissionTypeDescriptionAdmin Consent
ChannelMessage.Read.AllDelegatedRead channel messagesYes
Chat.ReadDelegatedRead user chat messagesNo
Chat.ReadWriteDelegatedRead and write user chat messagesNo
Team.ReadBasic.AllDelegatedRead basic team infoNo
TeamMember.Read.AllDelegatedRead team membersYes
Teams integration requires admin consent for some permissions. Ensure your Azure AD administrator grants consent for the app.

​
Microsoft SharePoint

PermissionTypeDescription
Sites.Read.AllDelegatedRead items in all site collections
Sites.ReadWrite.AllDelegatedRead and write items in all site collections

​
Microsoft Excel

PermissionTypeDescription
Files.ReadWrite.AllDelegatedFull access to user files
Sites.ReadWrite.AllDelegatedAccess SharePoint sites (for Excel files in SharePoint)

​
Microsoft Word

PermissionTypeDescription
Files.ReadWrite.AllDelegatedFull access to user files
Sites.ReadWrite.AllDelegatedAccess SharePoint sites (for Word files in SharePoint)

​
Complete Permissions Summary

Here’s a consolidated view of all permissions needed for full Microsoft 365 integration:
PermissionRequired For
offline_accessAll integrations
openidAll integrations
profileAll integrations
User.ReadAll integrations
Mail.ReadOutlook (email)
Mail.ReadWriteOutlook (email)
Mail.SendOutlook (email)
Calendars.ReadOutlook (calendar)
Calendars.ReadWriteOutlook (calendar)
Files.ReadOneDrive
Files.ReadWriteOneDrive
Files.ReadWrite.AllOneDrive, Excel, Word
Sites.Read.AllSharePoint
Sites.ReadWrite.AllSharePoint, Excel, Word
ChannelMessage.Read.AllTeams
Chat.ReadTeams
Chat.ReadWriteTeams
Team.ReadBasic.AllTeams
TeamMember.Read.AllTeams

​
Configure CrewAI Helm Values

After obtaining your OAuth credentials, configure them in your CrewAI Helm values: 
oauth:
  enabled: true
  secrets:
    microsoft:
      clientId: "your-application-client-id"
      clientSecret: "your-client-secret-value"
You can also configure product-specific credentials if you need separate Azure app registrations for different Microsoft services: 
oauth:
  secrets:
    microsoft:
      # Shared credentials (used as fallback)
      clientId: "shared-client-id"
      clientSecret: "shared-client-secret"

      # Product-specific overrides (optional)
      outlook:
        clientId: "outlook-specific-client-id"
        clientSecret: "outlook-specific-client-secret"
      teams:
        clientId: "teams-specific-client-id"
        clientSecret: "teams-specific-client-secret"
      onedrive:
        clientId: "onedrive-specific-client-id"
        clientSecret: "onedrive-specific-client-secret"
      sharepoint:
        clientId: "sharepoint-specific-client-id"
        clientSecret: "sharepoint-specific-client-secret"
      excel:
        clientId: "excel-specific-client-id"
        clientSecret: "excel-specific-client-secret"
      word:
        clientId: "word-specific-client-id"
        clientSecret: "word-specific-client-secret"
See Built-in Integrations Configuration for complete configuration options.

​
Troubleshooting

​
Common Issues

“AADSTS650052: The app needs access to a service”
  • Ensure all required permissions are added to the app registration
  • Grant admin consent for permissions that require it
“AADSTS700016: Application not found”
  • Verify the Client ID is correct
  • Ensure the app registration exists in the correct Azure AD tenant
“AADSTS7000215: Invalid client secret”
  • The client secret may have expired
  • Create a new client secret and update your configuration
Refresh token expires frequently
  • Ensure offline_access permission is granted
  • Check Azure AD token lifetime policies in your tenant