Set up Microsoft 365 for your environment

There are two ways to connect Microsoft 365 to your AI-Corporate environment. First choose which route fits your organization.

Route	When	What you do
AI-Corporate central app (default)	Personal connections with Outlook Mail, Outlook Calendar, Teams, and SharePoint/OneDrive.	An Entra administrator grants organizational consent via Connect Microsoft 365. After that, you enable the integrations as in step 5 of this article. You do not need your own app, client secret, or Identity Provider.
Your own Entra app	You want to centrally import SharePoint folders into the knowledge base, employees already sign in with Microsoft via your own app, or you want to manage the app yourself.	Follow this article starting at step 1.

If your organization already signs in with Microsoft through its own app (the environment's Microsoft ID field is filled in), then all connections use that own app. The central route does not apply.

Your own Entra app

With your own Microsoft Entra app, your organization can use the same app for Sign in with Microsoft and for Outlook, Teams, and SharePoint. You centrally determine which integrations and write actions are available. Users then only turn their personal connections on or off in Preferences → Tools → Connections.

The personal integrations work with supported models from OpenAI, Claude, Gemini, and Mistral. The selected model must be able to use tools. For personal connections, access follows the permissions of the signed-in Microsoft user. Organizational consent does not automatically sign in all employees and does not give the AI independent access to all mailboxes. The central SharePoint knowledge base uses separate app permissions and the existing knowledge base permissions, as described later in this article.

What do you need?

A Microsoft 365 organization with Microsoft Entra ID and accounts with access to the desired services.
An administrator who may register an app and grant organizational consent for the selected Microsoft Graph permissions. An Azure subscription role alone is not enough; your Entra role must allow this consent.
Administrative rights in the correct AI environment to make integrations available.
A platform administrator who can configure the Microsoft Identity Provider for this AI environment in Google Cloud Identity Platform.
An app registration in your own Microsoft directory, with a client secret and the two redirect URLs of the correct brand.

Signing in with Microsoft and access to Microsoft data are two separate features. A working Microsoft login alone does not mean Outlook, Teams, or SharePoint has been set up.

1. Register one organization app

Open the Microsoft Entra admin center and go to App registrations → New registration. Use a recognizable name, for example AI-Corporate – your organization name. For your own organization, choose Accounts in this organizational directory only (Single tenant).

Save the following information from Overview:

Data	What for?
Directory (tenant) ID	The Microsoft directory of your organization; this goes in the Microsoft ID field of the AI environment.
Application (client) ID	The registered app; this goes in the Microsoft Identity Provider.

These two IDs are different. Do not enter the client ID or Firebase tenant ID in Microsoft ID.

2. Set the correct redirect URLs

Go to Authentication → Add a platform → Web. For your brand, add both URLs below, exactly as shown. The first handles sign-in; the second handles consent for work account integrations.

Brand	Sign in with Microsoft	Work account integrations
AI-School	`https://ai-school-pro.firebaseapp.com/__/auth/handler`	`https://europe-west1-ai-school-pro.cloudfunctions.net/completeConnectorOAuth`
AI-Corporate	`https://ai-corporate.firebaseapp.com/__/auth/handler`	`https://europe-west1-ai-corporate.cloudfunctions.net/completeConnectorOAuth`
AI-Public	`https://ai-public-pro.firebaseapp.com/__/auth/handler`	`https://europe-west1-ai-public-pro.cloudfunctions.net/completeConnectorOAuth`

Use the URLs for the brand on which your environment runs. Your own organization name or tenant ID does not need to be filled into these URLs. The website URL, dashboard URL, and .web.app URL do not replace these callbacks. Register them as Web, even if you use the integration from a browser. You do not need to enable implicit token issuance or a public client flow for this.

3. Create a client secret and assign permissions

Go to Certificates & secrets → Client secrets → New client secret. Choose a suitable lifetime and safely save the Value as soon as it is visible. Provide the value through the agreed secure channel for platform management; the Secret ID is not the client secret. Track the expiration date and replace the secret before that date, including in the Identity Provider.

Then go to API permissions → Add a permission → Microsoft Graph → Delegated permissions. Add only the permissions for the integrations and actions your organization will offer.

Integration	Read permissions	Extra permissions for writing
Profile / basic	`User.Read`; the sign-in flow also requests `openid`, `profile`, `email`, and `offline_access`	None
Outlook Mail	`Mail.Read`	Drafts: `Mail.ReadWrite`. Send: `Mail.Send`.
Outlook Calendar	`Calendars.Read`	Writing: `Calendars.ReadWrite`.
Microsoft Teams	`Chat.Read`, `ChannelMessage.Read.All`	Posting: `Team.ReadBasic.All`, `Channel.ReadBasic.All`, `ChannelMessage.Send`.
SharePoint / OneDrive	`Sites.Read.All`, `Files.Read.All`	This work account integration does not offer write actions here.

Mail.ReadWrite does not grant send rights; Mail.Send is required separately for that. Teams posting writes text messages in a chosen channel, not private chat messages. For this integration, use Delegated permissions, not Application permissions. Even for permissions with All in the name, delegated access remains limited by the user's access.

Click Grant admin consent for your organization and verify that the selected permissions are shown as granted. This allows employees to use the approved access without having to grant organizational permissions themselves. Microsoft may still ask for sign-in, MFA, or renewed consent, depending on your policy.

4. Connect the app in two places to the AI environment

Have the platform administrator select the correct environment and perform these settings:

In Admin → Environment → Tenant: enable the sign-in method Microsoft and enter the Directory (tenant) ID in Microsoft ID.
In Google Cloud → Identity Platform → the relevant tenant → Identity providers → Microsoft: enable the provider and enter the Application (client) ID and the client secret Value of the same Entra app.

The Identity Provider belongs to the Firebase/Identity Platform tenant of your AI environment, not to another organization or the general Admin environment. The work account integration reuses the app from this provider. The client secret does not belong in user preferences, chat messages, or regular environment fields.

Provide platform management with the organization name, brand, Directory ID, client ID, secret value through the secure channel, expiration date, and desired integrations/permissions. An app ID alone is not enough.

5. Enable the integrations and write actions

Open the administration environment of your organization → Tools → MCP. Under Suite shortcuts, turn on the Microsoft 365 integration. The Microsoft rows will become visible; when the entire suite is off, those rows remain hidden.

Choose per integration whether it is available. In the Write actions column, choose separately:

Outlook Mail → Drafts: create and modify drafts.
Outlook Mail → Send: actually send an existing draft.
Outlook Calendar → Writing: create and modify appointments.
Microsoft Teams → Posting: post text messages in a chosen Teams channel.

Click Save. A write action only works if both the integration and the corresponding management permission are enabled, Microsoft has granted the required permissions, and the user has personally enabled the connection. The user does not receive any extra write-permissions form for this.

Availability

The settings must also be supported by your brand's backend. This write extension was purposefully released and tested on October 7, 2026 for OnderwijsSupport on AI-Corporate. This does not automatically mean the same extension has already been released for AI-School, AI-Public, or any other environment. Ask platform management for confirmation when write actions are missing.

6. Check the setup

Have a user sign in to the correct AI environment and enable the desired integration according to Using Microsoft integrations. Check whether Microsoft shows the name of your own Entra app.

First test a recognizable draft and an appointment without attendees. Check the saved items in Outlook. Then test sending with an agreed test recipient and Teams posting in an agreed test channel. An appointment with attendees may send invitations or updates. An accepted send command is not yet a confirmed delivery.

When permissions are expanded, the connection tries to refresh tokens. If Microsoft requires sign-in or consent again, have the user reconnect the existing connection. No second app or separate user setting needs to be created.

Troubleshooting

Problem	Check
`AADSTS50011` / redirect mismatch	Both callbacks registered exactly as Web, for the correct brand.
A different app name appears during consent	The correct AI environment, Directory ID, and tenant-specific Microsoft Identity Provider; then reconnect.
Login works, but the integration does not	Also check the connector callback, Graph permissions, and organizational consent.
Reading works, writing does not	Check management permission, matching delegated Graph permission, granted consent, and backend availability.
Client secret invalid or expired	The Value, not the Secret ID; update the new secret in the Identity Provider as well.
Integration missing for the user	Check availability in Tools, user permissions for connections, and the selected AI environment.

More information

Central SharePoint knowledge base: set up Microsoft

A centrally connected folder works through the organization app, without every employee enabling a personal SharePoint connection. This requires two separate consents: the application permission Sites.Selected with admin consent, and a read grant on the chosen SharePoint site. A working Microsoft login or admin consent alone is not enough.

1. Check the organization app

Use the same single-tenant app registration as for Microsoft sign-in in your AI environment. An existing app can be extended; a second integration app is not needed. In Microsoft Entra → App registrations → your app → Overview, check the Directory (tenant) ID and Application (client) ID. Use the client ID below, not the Object ID.

The Directory ID must be in Admin → Environment → Tenant → Microsoft ID. The client ID and the Value of a valid client secret must be in the Microsoft Identity Provider of exactly that AI environment. This configuration is maintained by platform management. An expired secret also prevents the central import; keep track of the expiration date.

The central server connection uses client_credentials and does not request an extra redirect URL. The existing Web redirects for sign-in and personal work account integrations remain necessary; use the brand-specific URLs from the table earlier in this article.

Open API permissions → Add a permission → Microsoft Graph → Application permissions.
Search for Sites.Selected, select this permission, and click Add permissions.
Have an authorized Entra administrator perform Grant admin consent for your organization.
Verify that Sites.Selected, type Application, is shown as granted.

The delegated permissions for personal Outlook, Teams, and SharePoint connections can remain on the same app. They do not replace the application permission for the central knowledge base. This central import does not require the application permissions Sites.Read.All, Sites.ReadWrite.All, or Sites.FullControl.All.

3. Grant the app separate read access to the site

This administrative action can be done with Microsoft Graph Explorer. Use an admin account in the same Microsoft directory, with SharePoint Administrator or a higher suitable admin role and access to the relevant site. An Azure subscription role or app ownership alone is not sufficient for this.

Sign in to Graph Explorer with the admin account and verify the organization shown.
Open your profile menu → Consent to permissions, find Sites.FullControl.All, and choose Consent to grant the required permission for Graph Explorer in this admin context. For some queries you can also open the full permissions pane via Modify Permissions → Open the permissions panel. This is a delegated admin permission to manage site grants; do not add it as a broad application permission on the knowledge base app. Use account-bound consent when organizational consent for all users is not needed.
Find the site ID with the GET below. Replace the example host and site path with those of your own folder. For a URL with /teams/, use that path instead of /sites/.

GET https://graph.microsoft.com/v1.0/sites/yourorganization.sharepoint.com:/sites/yoursite?$select=id,displayName,webUrl

The id value in the response is the full site ID, including host name and two GUIDs. Also check displayName and webUrl: the grant must be applied to the site where your folder actually resides.

First check existing grants with GET at the address below. If your client ID is already there with role read, you do not need to create a second grant. Have existing broader or different grants reviewed by your Microsoft administrator.

GET https://graph.microsoft.com/v1.0/sites/SITE-ID/permissions

If the grant is missing, choose POST, use the same address, and enter the following JSON under Request Body. Replace the two example values; CLIENT-ID-OF-YOUR-APP is the Application (client) ID of your integration app, not the Graph Explorer app.

{
  "roles": ["read"],
  "grantedToIdentities": [
    {
      "application": {
        "id": "CLIENT-ID-OF-YOUR-APP",
        "displayName": "NAME-OF-YOUR-INTEGRATION-APP"
      }
    }
  ]
}

Choose Run query. A successful addition returns 201 Created. Check the read role and the client ID in the response; Graph may show this under grantedToIdentitiesV2. Then check again with GET. Keep the permission ID for administration and possible later revocation.
Repeat this only for any other site whose knowledge base folders you intentionally want to connect.

Site grant and knowledge base permissions

The Microsoft grant gives the app read access to the entire selected site. The AI environment only imports the chosen folder and subfolders. Prefer a separate site for centrally shared knowledge. The existing knowledge base permissions determine which users receive the imported documents; individual SharePoint permissions are not inherited.

4. Connect the folder and check the result

Open Admin → Knowledge base → Add → SharePoint folders → Connect folder and use the real folder URL, not an invitation link or OneDrive overview address. Choose scope, audience, and publication status according to the knowledge base guide. A central source does not require a personal connector in user preferences.

Check with Refresh whether the documents have been processed without errors. Use Sync now for a new check and then ask a concrete chat question about an imported document. Verify that the answer mentions the correct central knowledge source.

Problem	Check on the Microsoft side
Login works, but the central folder does not	`Sites.Selected` must be of type Application and have admin consent; also check the separate site grant.
`403 Forbidden` when accessing the folder	Correct Microsoft directory, site ID, client ID, and `read` grant; admin consent alone does not grant site access.
`403` during the admin action in Graph Explorer	Delegated `Sites.FullControl.All`, granted consent, admin role, and access to the target site. Do not add a broad permission to the integration app as a solution.
Site works, folder not found	Check the real folder URL, document library, and site path; a OneDrive shortcut can point to a different site.
Secret expired or invalid	Have platform management update the new secret Value in the correct Microsoft Identity Provider.

For OnderwijsSupport on AI-Corporate, this central connection was released and tested on October 14, 2026. Availability on AI-School, AI-Public, or another environment must be confirmed by platform management.

Microsoft documentation: Selected permissions, add a site grant, and check site grants.

Your own Entra app​

What do you need?​

1. Register one organization app​

2. Set the correct redirect URLs​

3. Create a client secret and assign permissions​

4. Connect the app in two places to the AI environment​

5. Enable the integrations and write actions​

6. Check the setup​

Troubleshooting​

More information​

Central SharePoint knowledge base: set up Microsoft​

1. Check the organization app​

2. Add the application permission and grant admin consent​

3. Grant the app separate read access to the site​

4. Connect the folder and check the result​