Agent 365 Enablement
Register Outermind agents as first-class Microsoft Entra agent identities so they can send and receive mail under their own identity in your tenant.
Overview
Agent 365 is an optional per-tenant integration that creates Entra agent identity blueprints in your Microsoft 365 tenant. When enabled, each agent type (Personal Assistant, AI COS) gets its own dedicated Entra identity used for mail operations, governed by your organization's Microsoft Agent 365 control plane.
The one-time enablement ceremony must be completed by a Microsoft 365 Global Administrator before agents can operate under Agent 365 governance.
Prerequisites
- You must be signed in as an Outermind tenant administrator with the Settings permission.
- You must be signed in as a Microsoft 365 Global Administrator to complete the consent steps of the ceremony.
- Your Microsoft Entra tenant must permit application registration and service principal creation (see Troubleshooting if your tenant blocks this).
Enabling Agent 365
Before running the ceremony you must turn on the Agent 365 governance toggle for your tenant.
- In the admin console, go to Settings - Microsoft 365 (
/account-settings/microsoft-365). - Scroll to the Agent 365 governance section.
- Click Enable Agent 365 governance.
Enabling the toggle immediately redirects you to the enablement ceremony so you can complete setup in one flow. If Agent 365 is already fully configured, no redirect occurs and the status badge updates to Enabled.
You can disable Agent 365 at any time from the same section. Disabling reverts all mail traffic to the shared Outermind application identity without errors; the Entra objects remain in your tenant but are not used.
During registration
The registration wizard includes an optional Microsoft 365 Agents step so you can set up Agent 365 while you onboard. The step presents two independent authorization cards - you can complete either one without the other, skip both, or come back later:
Card A - Register agents in Microsoft Entra
Enables Agent 365 governance for your tenant and provisions Entra agent identity blueprints for all four agent types (Personal Assistant, AI COS, SME, and Standard Agent), even before any of those agents exist. After registration, the card shows a consent table where you grant admin consent per blueprint so agents of that type can act under their own identity once they are created.
Card B - Authorize Outermind for Exchange Online
A one-time, per-tenant Exchange Online authorization that replaces per-agent shared-mailbox creation. Once complete, Outermind scopes each agent's mailbox access automatically using RBAC-for-Applications. Card B is reachable and completable independently of Card A - you do not need to finish blueprint registration first.
The card provides:
- A pre-filled script with your tenant domain already substituted, presented as two equal ways to run it: Run in Azure Cloud Shell or No Azure subscription? Run locally.
- Step-by-step runbook for the Global Administrator running the script, covering both paths.
- A No Azure subscription? Run it locally instead section for Microsoft 365-only tenants (Cloud Shell requires an Azure subscription; the script does not).
- A Verify authorization button that checks real grant status (the management service principal registration and its required role assignments) without requiring any agents to exist yet. Use it after running the script to confirm the assignments landed.
The script can take up to about an hour to finish provisioning; you can leave it running in its terminal and continue. Click Verify authorization when you return to confirm it completed.
No Azure subscription? Cloud Shell is backed by an Azure storage account and so needs a subscription, but the setup script does not. Install PowerShell 7 and the Azure CLI, run Install-Module ExchangeOnlineManagement -Scope CurrentUser and az login --allow-no-subscriptions, then paste the same script into a local pwsh session. It still requires a Microsoft 365 Global Administrator, but no Azure subscription or extra license. See Mailbox Automation for the full walkthrough, and Teams Meeting Transcript Access for the equivalent Teams runbook.
This step is optional and fully non-blocking. You can complete, skip, or revisit either card independently, both during registration and later from Governance > Configuration > Microsoft Entra Agents. Both cards require a Microsoft 365 Global Administrator; if you are not one, the step provides a copyable link to hand off to an administrator.
How the Ceremony Works
The enablement ceremony runs once per tenant and creates the following for each agent type present in your tenant:
| Step | What happens |
|---|---|
| Application blueprint | Creates an Entra agent identity application for the agent type |
| Manager applications | Attaches the blueprint to the Agent 365 platform for manageability |
| Identity credential | Issues and encrypts a credential for the blueprint |
| Service principal | Registers the blueprint's service principal in your tenant |
| Permissions assignment | Declares inheritable Mail.ReadWrite and Mail.Send permissions |
| Admin consent | You grant consent so the agent can act within your tenant |
The ceremony is idempotent - if it is interrupted, re-running it skips completed steps and resumes at the first missing one.
Exchange management consent (mailbox RBAC)
In addition to the Microsoft Graph permissions above, agents that read and send mail under their own identity need an Exchange Online RBAC grant. Microsoft Graph cannot assign Exchange roles, so this leg is handled separately and requires its own admin consent during onboarding.
Grant the Outermind application:
| Requirement | Why |
|---|---|
Office 365 Exchange Online - Exchange.ManageAsApp application permission (admin consent) | Tells Microsoft Entra the application may connect to Exchange Online as itself |
| An Exchange management role for the application principal | Exchange Online RBAC decides what the application may actually do |
These split into two privilege tiers, deliberately separated:
- Tier 1 - mailbox access grants (required). To scope each agent to its mailbox, the application principal is assigned an Exchange role that grants mailbox access (such as
Application Mail Full Access, which coversMail.ReadWriteandMail.Send). This is the common, required tier and is requested for every tenant that enables Agent 365 mail. - Tier 2 - shared mailbox creation (standard, on by default). Creating agent-owned shared mailboxes additionally needs Mail Recipient Creation rights, a broader, tenant-wide capability. This is now a standard per-tenant onboarding grant requested for every tenant (it is no longer requested only on demand), and agent-owned shared mailboxes are enabled by default. Its absence never blocks tier 1.
Tier 2 is the highest-privilege capability in this integration. It is enabled by default for every tenant; a per-tenant toggle is retained as a kill-switch so you can disable agent-owned shared-mailbox creation for your organization at any time, in which case agents fall back to supervisor-mailbox scoping.
Running the Ceremony
The enablement ceremony can be started from several places in the admin console:
- Automatic prompt after re-consent - When you grant admin re-consent from the re-authorization page or the Microsoft 365 account-settings page, a banner appears if Agent 365 is enabled but not yet set up. Click Set up Agent 365 to go directly to the ceremony.
- First-run onboarding wizard - The wizard detects the setup requirement automatically and routes you to the ceremony as part of initial authorization.
- Direct link - Navigate directly to
/governance/agent-365/ceremonyat any time.
Note: The setup prompt only appears for users with the
settings:writepermission, which is required to run the ceremony.
Step 1: Check current status
When the page loads, it fetches the current detection status and displays any agent types that need setup. Each agent type card shows its consent status and the next pending step.
Step 2: Run enablement
Click Run enablement. The ceremony runs all provisioning legs for each agent type in sequence. A progress list shows which steps have completed (green check) and which step is currently running (blue pulse).
Step 3: Grant admin consent
After provisioning completes, each agent type that requires consent displays a Grant admin consent in Microsoft 365 link. Click it to open the Microsoft consent page in a new tab.
Complete consent in the Microsoft 365 admin center, then return to this page and click I've granted consent to record the approval.
Step 4: Continue to console
Once all agent types show Setup complete, click Continue to console to return to the admin console.
Re-consent Banner
When Outermind adds new Microsoft Graph permissions to the Agent 365 integration, tenants that already have Agent 365 enabled will see a warning banner at the top of the admin console:
Re-consent required: Agent 365 governance is enabled, but your organization has not approved the updated Microsoft permissions. Agent 365 provisioning stays paused until an administrator re-approves.
This banner is shown only to administrators with the Administration Hub permission. It disappears automatically once an administrator completes the re-consent flow.
How to resolve the re-consent banner
- Click Re-approve now in the banner, or navigate to Settings > AI Configuration and select Re-authorize Microsoft 365.
- Sign in as a Microsoft 365 Global Administrator when prompted.
- Review the permissions listed on the consent screen and click Accept.
- Return to the admin console. The banner disappears within a few seconds once the new consent is recorded.
If the banner reappears after completing these steps, wait 30 seconds and refresh the page. Entra consent propagation can take a short time. Contact Outermind support if it persists.
Re-running After Interruption
If the ceremony was interrupted (browser closed, network error, or consent was not granted), click Run again. The ceremony resumes at the first incomplete step - it does not repeat steps that already succeeded.
Troubleshooting
"Tenant policy blocked Agent 365 setup"
Your Microsoft Entra tenant has a policy that prevents application registration or service principal creation. To resolve this:
- Contact your Microsoft Entra administrator.
- Ask them to update your tenant's application creation and identity policies to permit service principal registration.
- Once the policy is updated, return to this page and click Run again.
Ceremony fails with an error for a specific agent type
Each agent type card shows an error message if its provisioning did not complete. The error message describes the failure. Common causes:
- Graph API permission not yet active - Wait a few minutes and run the ceremony again. New Entra app permissions can take time to propagate.
- Credential issuance failed - Contact Outermind support with the error text shown on the card.
"Already configured" is shown but agents are not working
The detection check verifies that the toggle is on, blueprint rows exist for all in-use agent types, and live Graph calls confirm those blueprints still exist in Entra. If this check passes but mail is not routing via Agent 365, contact Outermind support - the issue is likely in the runtime token flow rather than the provisioning state.
Consent was granted but the status still shows "pending"
Entra consent propagation can take several seconds. Wait 30 seconds and click Run again to re-check. If the status does not update after two tries, contact Outermind support.
FAQ
Can a non-administrator run the ceremony?
No. The ceremony creates Entra application objects and grants Mail permissions in your tenant, which requires Global Administrator privileges.
Does this affect existing email processing?
No. Until Agent 365 is fully provisioned and consent is granted for an agent type, that agent continues to use the standard Outermind multi-tenant application identity for all Microsoft 365 calls. Agent 365 mail routing activates only after the ceremony completes successfully.
What permissions are granted?
The ceremony grants Mail.ReadWrite and Mail.Send as inheritable application permissions on each agent blueprint. No other Microsoft 365 permissions (Files, Sites, Chat, Groups, Directory) are requested for the agent identity - those continue to use the shared Outermind platform application.
Can the ceremony be undone?
Yes. Go to Settings - Microsoft 365 and click Disable Agent 365 governance. All mail traffic reverts to the shared application identity without errors. The Entra objects remain in your tenant but are not used. Contact Outermind support if you need the objects removed from your Entra directory.