Skip to main content

Guide for IT administrators

Connect Microsoft 365

The Microsoft 365 integration lets employees use AI-School to search their own Outlook Mail, calendar, Teams and SharePoint, and optionally draft emails. As an administrator, you can grant consent for your entire organisation in one go here.

How does the integration work?

  • All permissions are delegated: the AI acts on behalf of the signed-in employee and can only see what that employee is allowed to see in Microsoft 365. It can't access other mailboxes.
  • Organisation-wide consent doesn't enable anything automatically. Each employee chooses which integrations the AI can use.
  • Write actions work only if you approve them here and your AI environment administrator enables them. Nothing is ever sent or posted without the employee's instruction.

Who can grant consent?

An account with the Entra role Global Administrator, Privileged Role Administrator or Cloud Application Administrator. One of these roles is always required to read Teams channel messages.

When do you need your own Microsoft app?

You don’t need your own app for personal connections to Outlook Mail, Outlook Calendar, Teams and SharePoint/OneDrive. These use AI-School’s central app; you only need to grant consent on this page.

You do need to register your own app in Microsoft Entra if:

  • you want to import SharePoint folders into the knowledge base centrally. This import works without a signed-in employee, using the Sites.Selected application permission, which you grant to your own app for each site.
  • employees already sign in with Microsoft using your organisation’s own app. In that case, all connections use your own app, and the link on this page doesn’t apply: add the permissions to your own app and grant admin consent there.

A custom app also has other benefits:

  • When signing in and granting consent, employees see the name of your organisation’s own app.
  • Sign-in and connection are only possible with accounts from your own Microsoft organisation.
  • You manage the permissions, client secret and app yourself. You can disable or revoke access in your own Entra environment, without involving us.
  • The same app also handles sign-in with Microsoft, so employees can sign in with their work account.

A custom app does require maintenance: the client secret expires and must be renewed in time, on our end too.

Learn how to set up your own Microsoft app

Choose what to approve

You can approve everything at once or select only some permissions. You can always approve more later using a new link; the new consent will be added to the previous consent.

Sign-in, the basic profile (User.Read) and maintaining access (offline_access) are always requested.

Your domain lets you grant consent only for your own organisation. Leave it blank to grant consent for the organisation associated with the account you use to sign in.

https://login.microsoftonline.com/organizations/v2.0/adminconsent?client_id=c7b09c4b-836c-4815-aafb-42660c051fda&scope=openid%20profile%20email%20offline_access%20https%3A%2F%2Fgraph.microsoft.com%2FUser.Read%20https%3A%2F%2Fgraph.microsoft.com%2FMail.Read%20https%3A%2F%2Fgraph.microsoft.com%2FMail.ReadWrite%20https%3A%2F%2Fgraph.microsoft.com%2FMail.Send%20https%3A%2F%2Fgraph.microsoft.com%2FCalendars.Read%20https%3A%2F%2Fgraph.microsoft.com%2FCalendars.ReadWrite%20https%3A%2F%2Fgraph.microsoft.com%2FChat.Read%20https%3A%2F%2Fgraph.microsoft.com%2FChannelMessage.Read.All%20https%3A%2F%2Fgraph.microsoft.com%2FTeam.ReadBasic.All%20https%3A%2F%2Fgraph.microsoft.com%2FChannel.ReadBasic.All%20https%3A%2F%2Fgraph.microsoft.com%2FChannelMessage.Send%20https%3A%2F%2Fgraph.microsoft.com%2FSites.Read.All%20https%3A%2F%2Fgraph.microsoft.com%2FFiles.Read.All&redirect_uri=https%3A%2F%2Fwww.ai-school.info%2Fmicrosoft-koppeling%2F&state=microsoft-koppeling
Grant consent in Microsoft

After you approve, Microsoft will send you back to this page to see the result.

Next

  1. The administrator of your AI-School environment enables the Microsoft 365 suite in Admin → Tools → MCP, including the integrations and write actions they want to use.
  2. Employees can then enable the integration themselves. The guide explains how: Enable Microsoft integrations
  3. You can revoke access at any time in the Microsoft Entra admin center under Enterprise applications → AI-School → Permissions.