Connect Microsoft 365

For any operator who wants to plug Outlook, Calendar and OneDrive into Apollia, whether the account is personal (outlook.com, hotmail.com, live.com) or professional (Microsoft 365, Entra ID).

Prerequisites

• Apollia running.
• A Microsoft account, personal or professional.
• Your organisation's policy, if it has deployed one, does not deny remote connections.
• If your Entra ID tenant requires administrative approval, the administrator has to pre-approve the application.
• An active internet connection.

There is nothing to register and nothing to paste. If you have just read the Google page, that difference is deliberate and explained in the integrations overview.

Nothing to configure

Microsoft 365 works as soon as Apollia is installed. Apollia registers one application with Microsoft and ships its identifier inside the build, so you go straight to connecting your account.

That identifier is not a secret being leaked. In Microsoft's model a desktop application is a public client: it holds no password at all, proves each request with PKCE, and its application identifier is a public GUID. Anyone can read it out of any copy of the application, which is precisely why the design does not depend on hiding it.

You can still use your own registration if you prefer, and skipping straight to the steps below is the normal path.

Which account type I can use

Both work through the same registration. The endpoint used (/common/) accepts either:

• personal Microsoft accounts (outlook.com, hotmail.com, live.com),
• professional or education accounts (Entra ID, M365 Business, M365 Developer tenant).

See the observable differences in the table further down.

Steps

1. In the sidebar, open Connections, then open the Microsoft 365 page: from the list, or from Add a connection when it is not listed yet.

   On screen: the Microsoft 365 page, with the Connect an account button under the Accounts tab.

2. Click Connect an account. A window opens inside Apollia and your browser opens the Microsoft consent page.

3. Authenticate with your Microsoft account, then accept the permissions (Mail, Calendar, Files).

   On screen: the Microsoft consent page, with the list of requested accesses (Mail, Calendar, Files) and the No and Yes buttons.

4. Back in Apollia, the window detects the return automatically and confirms that Microsoft 365 is added, with Try and Done. Your account appears under the Accounts tab of the page.

   On screen: the Accounts tab of the Microsoft 365 page, showing the connected account.

What you can do

Outlook (mail):

• Reads: search messages, read a specific mail, list your folders. Reading your account is reading personal data, so Apollia asks for your agreement; Always for this agent stops the question for that agent.
• Writes and sends, with your agreement: send a mail, reply, move a message.

Calendar:

• Reads, under the same rule: list events, open a specific event.
• Writes, with your agreement: create or change an event.
• Deletion, with your agreement like any write: delete an event. There is no phrase to type.

OneDrive (read-only):

• Search your files, read the metadata, download a file, list recent files.
• There is no OneDrive write, and no workspace folder pattern like Google's Drive/Apollia/<agent>/.

Microsoft Teams is not covered.

Multiple accounts

As with Google, you can connect several Microsoft accounts, and each keeps its own token. Each connected account is a connection of its own. Its tools are granted to an agent account by account, on the agent's sheet, and a call runs as the account that was granted and as no other.

Personal vs professional differences

Capability	Personal account	Professional account
Mail backend	Outlook.com	Exchange Online
Calendar backend	Outlook.com	Exchange Online
Drive backend	OneDrive Personal	OneDrive for Business
Admin consent	Not applicable	Possible depending on tenant policy
Domains	outlook.com, hotmail.com, live.com	<you>@<company>.onmicrosoft.com or a custom domain

The tools are the same on both sides, only the backend answering changes.

Use your own application registration

Optional. Apollia's own registration covers both account types, so most operators never need this. Two situations justify it: your organization wants the connection to appear under an application it controls and can audit, or your Entra ID tenant blocks applications it has not registered itself.

In the Microsoft Entra admin center (or the Azure portal, "App registrations"):

1. Choose New registration.
2. For supported account types, pick Accounts in any organizational directory and personal Microsoft accounts, which is what makes both an outlook.com address and a work account usable. Picking a single-tenant option instead limits sign-in to your own directory.
3. Under Redirect URI, add a platform of type Mobile and desktop applications and enter http://127.0.0.1. Apollia listens on a loopback port picked at connection time, and Microsoft accepts any port on that host.
4. Register, then copy the Application (client) ID from the overview page. It looks like 00000000-1111-2222-3333-444444444444.

In Apollia.

1. Open the Microsoft 365 page in Connections. Under the Accounts tab, the Microsoft client section holds the client.
2. Paste the identifier into the Client ID field and save. It is kept in a configuration file of your computer, readable by your user only. There is no secret to enter, a public client has none.
3. Click Test the client.

Clearing the field again restores the identifier shipped with Apollia. Existing connected accounts were issued against the previous registration, so disconnect and reconnect them after a change.

Alternative for a shell or a headless host. APOLLIA_MICROSOFT_CLIENT_ID takes priority over what was entered on the page, and only applies to processes launched from the shell where you exported it. See Environment variables.

Verification

• The Accounts tab lists the account, and the page header reads 1 active.
• On the page, click Try and ask "List my last 3 Outlook mails". Apollia answers with the tools of this connection, and asks for your agreement before it reads the account.
• Then try "Send a mail to with the subject test". A consent request appears before sending.
• The system keychain holds an apollia-connector-microsoft entry tied to your address.

If it does not work

• The Microsoft 365 page reads "Setup required": it cannot, on a build that carries the identifier, and neither an empty environment variable nor an emptied Client ID field produces it: both are skipped when empty and the shipped identifier stands. If you do see it, the build itself was compiled without the identifier. Check apollia-os connector client-id list, which names the source of the client it resolved, env, file, builtin or none. Plain connector list shows the registered connectors, their services and their operation counts, and says nothing about the client identifier.
• Microsoft rejects the redirect URI: only reachable with your own registration. It is missing its Mobile and desktop applications platform, or that platform does not list http://127.0.0.1. A registration created as "Web" will not work. Clear the client ID field to fall back on Apollia's own registration.
• Microsoft answers that the account does not exist in the directory: also specific to your own registration, and it means the supported account types were set to a single tenant. Recreate it with Accounts in any organizational directory and personal Microsoft accounts, or clear the field to use Apollia's.
• Consent refused at the Microsoft screen: a managed Entra ID tenant often requires an organization-level approval before an external application may be used at all. The error text comes from Microsoft, not from Apollia, and it names the tenant policy at fault. Ask your administrator to pre-approve the application, or use a personal Microsoft account.
• outlook.send fails on a recipient: Microsoft Graph validates recipients more strictly than Google does. Apollia surfaces Graph's own error verbatim, prefixed with the HTTP status. Check the target address and make sure there is no dead alias.
• OneDrive write refused: that is expected, OneDrive is read-only.
• Connecting stops with "Refused by your organisation's policy": your organisation's policy denies connections to online services on this computer, and nothing was sent to Microsoft. Only the person who manages that policy can grant an exception.

Disconnecting an account

On the Microsoft 365 page, under the Accounts tab, click Disconnect next to the account and confirm. The token is deleted from the local secret store. To revoke on the Microsoft side too, go to https://myaccount.microsoft.com and remove the Apollia application permission.

Technical reference: Apollia reference , Microsoft OAuth flow, full scopes, proactive refresh.