> ## Documentation Index
> Fetch the complete documentation index at: https://enterprise-docs.crewai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft 365 Integrations

> Configure Microsoft Outlook, OneDrive, Teams, SharePoint, Excel, and Word integrations

## Overview

CrewAI supports integration with Microsoft 365 applications including Outlook (email and calendar), OneDrive, Teams, SharePoint, Excel, and Word. This guide walks you through setting up OAuth credentials in the Azure portal to enable these integrations.

## Prerequisites

* Access to your organization's Azure portal (most organizations using Microsoft 365 already have this)
* Permissions to create app registrations in your Azure tenant
* Admin consent capability for granting API permissions (may require your Microsoft 365 or Azure administrator)

## Azure App Registration Setup

### Step 1: Navigate to App Registrations

1. Sign in to the [Azure Portal](https://portal.azure.com/)
2. Search for **App registrations** in the top search bar
3. Click **New registration**

### Step 2: Register Your Application

1. **Name**: Enter a name for your application (e.g., "CrewAI Integration")
2. **Supported account types**: Select the appropriate option:

| Option                 | Description                                       | Use Case                                          |
| ---------------------- | ------------------------------------------------- | ------------------------------------------------- |
| Single tenant          | Only accounts in your organization                | Enterprise deployment with internal users only    |
| Multitenant            | Accounts in any organizational directory          | Enterprise deployment with external collaborators |
| Multitenant + personal | Any organizational or personal Microsoft accounts | Broadest access including personal accounts       |

<Tip>
  For most enterprise deployments, select **Accounts in this organizational directory only** (single tenant) for better security control.
</Tip>

<Note>
  If you select single tenant, you'll need to configure your **Directory (tenant) ID** in CrewAI. See [Configure CrewAI Helm Values](#configure-crewai-helm-values) below.
</Note>

3. **Redirect URI**:

   * Select **Web** as the platform
   * Add the redirect URI:

     **Default configuration (NGINX with shared hostname):**

     ```
     https://<YOUR_APPLICATION_HOST>/oauthsvc/oauth/add
     ```

     **Separate OAuth hostname (GKE/ALB with `path: "/"`):**

     ```
     https://<YOUR_OAUTH_HOST>/oauth/add
     ```

   See [OAuth Redirect URI Patterns](/features/built-in-integrations-overview#oauth-redirect-uri-patterns) for the correct redirect URI format based on your ingress configuration.

4. Click **Register**

### Step 3: Note Your Application Credentials

After registration, you'll be taken to the app's overview page. Note the following values:

* **Application (client) ID**: This is your Client ID
* **Directory (tenant) ID**: Your organization's tenant ID

## Configure API Permissions

### Step 1: Add Microsoft Graph Permissions

1. In your app registration, click **API permissions** in the left sidebar
2. Click **Add a permission**
3. Select **Microsoft Graph**
4. Select **Delegated permissions**
5. Add the permissions required for your integrations (see [Required Scopes](#required-scopes-per-integration) below)
6. Click **Add permissions**

### Step 2: Grant Admin Consent

Some permissions require admin consent. If you have admin privileges:

1. Click **Grant admin consent for \[Your Organization]**
2. Click **Yes** to confirm

<Warning>
  If you don't have admin privileges, you'll need to request consent from your organization's Microsoft 365 or Azure administrator. Without admin consent, some integrations may not work properly.
</Warning>

## Create Client Secret

### Step 1: Generate a New Secret

1. In your app registration, click **Certificates & secrets** in the left sidebar

2. Under **Client secrets**, click **New client secret**

3. Enter a description (e.g., "CrewAI Production")

4. Select an expiration period:
   * **6 months** - More secure, requires regular rotation
   * **12 months** - Balance of security and convenience
   * **24 months** - Less maintenance, but less secure

5. Click **Add**

### Step 2: Save the Secret Value

<Warning>
  **Important**: Copy the secret **Value** immediately. It will only be shown once. If you navigate away without copying it, you'll need to create a new secret.
</Warning>

Store the Client ID and Client Secret securely for CrewAI configuration.

## Required Scopes per Integration

The following permissions should be added to your app registration. All integrations require the base permissions, plus integration-specific permissions.

### Base Permissions (Required for All)

| Permission       | Type      | Description                              |
| ---------------- | --------- | ---------------------------------------- |
| `offline_access` | Delegated | Maintain access to data (refresh tokens) |
| `openid`         | Delegated | Sign users in                            |
| `profile`        | Delegated | View users' basic profile                |
| `User.Read`      | Delegated | Sign in and read user profile            |

### Microsoft Outlook (Email)

| Permission       | Type      | Description              |
| ---------------- | --------- | ------------------------ |
| `Mail.Read`      | Delegated | Read user mail           |
| `Mail.ReadWrite` | Delegated | Read and write user mail |
| `Mail.Send`      | Delegated | Send mail as the user    |

### Microsoft Outlook (Calendar)

| Permission            | Type      | Description                   |
| --------------------- | --------- | ----------------------------- |
| `Calendars.Read`      | Delegated | Read user calendars           |
| `Calendars.ReadWrite` | Delegated | Read and write user calendars |

### Microsoft OneDrive

| Permission            | Type      | Description                              |
| --------------------- | --------- | ---------------------------------------- |
| `Files.Read`          | Delegated | Read user files                          |
| `Files.ReadWrite`     | Delegated | Read and write user files                |
| `Files.ReadWrite.All` | Delegated | Full access to all files user can access |

### Microsoft Teams

| Permission                | Type      | Description                       | Admin Consent |
| ------------------------- | --------- | --------------------------------- | ------------- |
| `ChannelMessage.Read.All` | Delegated | Read channel messages             | Yes           |
| `Chat.Read`               | Delegated | Read user chat messages           | No            |
| `Chat.ReadWrite`          | Delegated | Read and write user chat messages | No            |
| `Team.ReadBasic.All`      | Delegated | Read basic team info              | No            |
| `TeamMember.Read.All`     | Delegated | Read team members                 | Yes           |

<Note>
  Teams integration requires admin consent for some permissions. Ensure your organization's Microsoft 365 or Azure administrator grants consent for the app.
</Note>

### Microsoft SharePoint

| Permission            | Type      | Description                                  |
| --------------------- | --------- | -------------------------------------------- |
| `Sites.Read.All`      | Delegated | Read items in all site collections           |
| `Sites.ReadWrite.All` | Delegated | Read and write items in all site collections |

### Microsoft Excel

| Permission            | Type      | Description                                             |
| --------------------- | --------- | ------------------------------------------------------- |
| `Files.ReadWrite.All` | Delegated | Full access to user files                               |
| `Sites.ReadWrite.All` | Delegated | Access SharePoint sites (for Excel files in SharePoint) |

### Microsoft Word

| Permission            | Type      | Description                                            |
| --------------------- | --------- | ------------------------------------------------------ |
| `Files.ReadWrite.All` | Delegated | Full access to user files                              |
| `Sites.ReadWrite.All` | Delegated | Access SharePoint sites (for Word files in SharePoint) |

## Complete Permissions Summary

Here's a consolidated view of all permissions needed for full Microsoft 365 integration:

| Permission                | Required For            |
| ------------------------- | ----------------------- |
| `offline_access`          | All integrations        |
| `openid`                  | All integrations        |
| `profile`                 | All integrations        |
| `User.Read`               | All integrations        |
| `Mail.Read`               | Outlook (email)         |
| `Mail.ReadWrite`          | Outlook (email)         |
| `Mail.Send`               | Outlook (email)         |
| `Calendars.Read`          | Outlook (calendar)      |
| `Calendars.ReadWrite`     | Outlook (calendar)      |
| `Files.Read`              | OneDrive                |
| `Files.ReadWrite`         | OneDrive                |
| `Files.ReadWrite.All`     | OneDrive, Excel, Word   |
| `Sites.Read.All`          | SharePoint              |
| `Sites.ReadWrite.All`     | SharePoint, Excel, Word |
| `ChannelMessage.Read.All` | Teams                   |
| `Chat.Read`               | Teams                   |
| `Chat.ReadWrite`          | Teams                   |
| `Team.ReadBasic.All`      | Teams                   |
| `TeamMember.Read.All`     | Teams                   |

## Configure CrewAI Helm Values

After obtaining your OAuth credentials, configure them in your CrewAI Helm values:

```yaml theme={null}
oauth:
  enabled: true
  secrets:
    microsoft:
      clientId: "your-application-client-id"
      clientSecret: "your-client-secret-value"
```

### Single-Tenant Configuration

If you registered your Azure app as **single tenant** (recommended for enterprise), you must also configure your Directory (tenant) ID:

```yaml theme={null}
oauth:
  enabled: true
  secrets:
    microsoft:
      clientId: "your-application-client-id"
      clientSecret: "your-client-secret-value"
      tenantId: "your-directory-tenant-id"
```

<Tip>
  Find your **Directory (tenant) ID** on your app registration's overview page in the Azure Portal.
</Tip>

If `tenantId` is not configured, CrewAI uses Microsoft's multi-tenant endpoint (`common`), which allows users from any Microsoft 365 organization to connect their accounts.

### Product-Specific Configuration

You can configure different credentials or tenant IDs for specific Microsoft services if needed:

```yaml theme={null}
oauth:
  secrets:
    microsoft:
      # Shared credentials (used as fallback)
      clientId: "shared-client-id"
      clientSecret: "shared-client-secret"
      tenantId: "shared-tenant-id"

      # Product-specific overrides (optional)
      outlook:
        clientId: "outlook-specific-client-id"
        clientSecret: "outlook-specific-client-secret"
        tenantId: "outlook-specific-tenant-id"
      teams:
        clientId: "teams-specific-client-id"
        clientSecret: "teams-specific-client-secret"
        tenantId: "teams-specific-tenant-id"
      onedrive:
        clientId: "onedrive-specific-client-id"
        clientSecret: "onedrive-specific-client-secret"
        tenantId: "onedrive-specific-tenant-id"
      sharepoint:
        clientId: "sharepoint-specific-client-id"
        clientSecret: "sharepoint-specific-client-secret"
        tenantId: "sharepoint-specific-tenant-id"
      excel:
        clientId: "excel-specific-client-id"
        clientSecret: "excel-specific-client-secret"
        tenantId: "excel-specific-tenant-id"
      word:
        clientId: "word-specific-client-id"
        clientSecret: "word-specific-client-secret"
        tenantId: "word-specific-tenant-id"
```

See [Built-in Integrations Configuration](/reference/chart-values/oauth) for complete configuration options.

## Activate the Integration

After deploying your updated Helm values, sync integrations to make them available to users — see [Activate Integrations After Deployment](/features/built-in-integrations-overview#activate-integrations-after-deployment).

## Troubleshooting

### Common Issues

**"AADSTS650052: The app needs access to a service"**

* Ensure all required permissions are added to the app registration
* Grant admin consent for permissions that require it

**"AADSTS700016: Application not found"**

* Verify the Client ID is correct
* Ensure the app registration exists in the correct Azure tenant

**"AADSTS7000215: Invalid client secret"**

* The client secret may have expired
* Create a new client secret and update your configuration

**Refresh token expires frequently**

* Ensure `offline_access` permission is granted
* Check token lifetime policies in your Azure tenant