Setting Up Outlook and Outlook Calendar
Outlook mail and calendar ingestion uses application permissions scoped to an allow-listed set of mailboxes — not per-user delegated consent. Complete Step 2 to restrict which mailboxes the app can access before granting admin consent in Step 4.
1. Add Application Permissions — Read
Add the following application permissions in your Azure app registration under API permissions → Microsoft Graph → Application permissions.
These scopes enable Digital Twin to ingest Outlook email and calendar content for users in your allow-listed security group.
| Permission | Outlook Mail | Outlook Calendar | What it grants |
|---|---|---|---|
User.Read.All | ✅ | ✅ | Read all users' profiles in the directory |
GroupMember.Read.All | ✅ | ✅ | Read group membership lists |
Group.Read.All | ✅ | ✅ | Read all groups and their properties |
Mail.Read | ✅ | — | Read mail in all mailboxes |
MailboxSettings.Read | ✅ | — | Read user mailbox settings |
Calendars.Read | — | ✅ | Read calendars in all mailboxes |
Copy the full scope list into Azure:
User.Read.All
GroupMember.Read.All
Group.Read.All
Mail.Read
MailboxSettings.Read
Calendars.Read
Once these application permissions are added, grant admin consent using Grant admin consent for [your tenant] in the Azure Portal (see Step 4).
2. Limit Application Access to Specific Mailboxes
Background
Apps configured with application permissions can, by default, access all mailboxes in an organization on Exchange Online. Many administrators want to limit an app to only specific mailboxes.
You can identify the mailboxes to permit by placing them in a mail-enabled security group, then create an application access policy in Exchange Online PowerShell to restrict the app to that group only.
Steps to configure
- Install the Exchange Online PowerShell module — follow Microsoft's guide: Exchange Online PowerShell
- Connect to Exchange Online PowerShell — follow Microsoft's guide: Connect to Exchange Online PowerShell
- Create a mail-enabled security group — add the mailboxes you want Digital Twin to access: Manage mail-enabled security groups
- Create an application access policy — limit the app's mailbox access to that group: Limit application permissions to specific mailboxes
Do not skip Step 2 unless you intend for the app to have access to every mailbox in your tenant.
3. Add Delegated Permissions — Write Actions (Optional)
Step 1 uses application permissions for ingestion. Write actions are different: add the scopes below as delegated permissions only.
In Azure, go to API permissions → Microsoft Graph → Delegated permissions. Do not add these under Application permissions — write actions run as the signed-in user, not the app.
The application permissions in Step 1 are enough for ingestion and search. To let users take action from chat — send email, schedule events, and more — each user connects with delegated permissions when they first use a write action.
Every write action still requires the user to review and approve the exact change before anything is sent or modified.
Example use cases
- Send an email: "Draft and send a follow-up to the client with yesterday's action items"
- Schedule a meeting: "Block 30 minutes on my calendar tomorrow at 2 PM for a product review"
- Update a draft: "Save this summary as a draft reply to the latest thread from Acme Corp"
Additional delegated scopes for write actions
These are delegated scopes — separate from the application permissions in Step 1. Add only the ones that match the write actions you want to enable.
| Service | What it enables | Permission type | Permission |
|---|---|---|---|
| Outlook | Send emails | Delegated | Mail.Send |
| Outlook | Create, modify, or delete emails & drafts | Delegated | Mail.ReadWrite |
| Outlook Calendar | Create, modify, or delete events | Delegated | Calendars.ReadWrite |
Use the tabs below to copy the delegated scope list into Azure under Delegated permissions.
- Outlook
- Outlook Calendar
Mail.Send
Mail.ReadWrite
Calendars.ReadWrite
4. Grant Admin Consent
Once all required permissions are added (application permissions from Step 1, plus any optional delegated write scopes from Step 3), click Grant admin consent for [your tenant] in the Azure Portal.
Pre-approving permissions means users only need to sign in for delegated write actions — they cannot modify or decline individual permissions. This resolves the common issue of tenants that have disabled user-level consent.
5. Set Up Redirect URIs
a. On your app registration page, open the Authentication tab and click Add a platform → Web.
b. Add the following redirect URIs:
Replace <instanceID> with your customer domain for BYOC deployments, or viven.ai for Viven-hosted.
https://stage-digitaltwin.<instanceID>/oauth/microsoft/callback
https://digitaltwin.<instanceID>/oauth/microsoft/callback
https://stage-digitaltwin.<instanceID>/oauth/microsoft/data_source/callback
https://digitaltwin.<instanceID>/oauth/microsoft/data_source/callback
c. In the Advanced settings section of the same tab, enable Access tokens (used for implicit flows).
d. Click Save. Outlook and Outlook Calendar are now ready for integration.