Skip to main content

Mailbox Automation

Let Outermind create and scope each agent's Exchange shared mailbox automatically, with no ticket and no manual provisioning.

Overview​

Mailbox Automation is the Administration Hub page that enables App E (Outermind — Mailbox Automation), the dedicated Microsoft Entra application that manages agent mailboxes in Exchange Online. It replaces the earlier standalone Exchange authorization wizard — that page has been retired and its runbook now lives here.

Enabling this hands Outermind the recurring work of giving each agent a mailbox: the shared mailbox is created and scoped to that agent automatically, every time. Leaving it off costs nothing but time — agents are still created and still work, but a Platform Admin has to provision each agent's mailbox by hand.

Prerequisites​

  • You must be signed in as an Outermind tenant administrator with the Settings (settings:write) permission to view and use this page.
  • Approving the underlying Microsoft 365 application requires a Microsoft 365 Global Administrator.

The two halves​

Mailbox Automation has two independent parts, and the page tracks and reports on them separately:

  1. Entra consent — a Global Administrator grants admin consent to the Outermind — Mailbox Automation application (Exchange.ManageAsApp) in Microsoft Entra.
  2. Exchange Online setup script — a PowerShell ceremony, run in your tenant, that registers Outermind's service principal in Exchange Online and assigns it the management roles it needs.

Both steps are required. Consent alone is not enough, and the setup script alone is not enough — the page never reports Mailbox Automation as working until both halves are confirmed.

Why two indicators instead of one? Consent-granted-but-script-not-run is a common, ordinary intermediate state. Collapsing the two into a single status would hide exactly the step you still need to complete.

Enabling Mailbox Automation​

  1. In the admin console, go to Administration > Mailbox Automation (/administration/mailbox-automation).
  2. The page checks both halves automatically when it loads and shows their current status:
    • Consent status — reflects live verification against Microsoft Entra.
    • Exchange Online setup script status — reflects live verification against Exchange Online.
  3. If consent has not been granted, click Authorize in Microsoft 365 and sign in as a Global Administrator to approve the application.
  4. If the setup script has not been run (or is only partly complete), follow the runbook on the page: copy the pre-filled PowerShell script and run it as a Global Administrator. The page offers two equal ways to run it - Run in Azure Cloud Shell, or No Azure subscription? Run locally for a local PowerShell 7 session (see Running the script without an Azure subscription below). The script can take up to about an hour to finish provisioning; you can leave it running and come back.
  5. Click Verify authorization (or Re-check) after running the script to confirm it landed. Outermind reports Mailbox Automation as working only once both halves check out.

Running the script without an Azure subscription​

Azure Cloud Shell stores your shell session in an Azure storage account, so it requires an Azure subscription. A Microsoft 365-only tenant that has never had one will hit Microsoft's "subscription required" wall when it tries to open Cloud Shell.

You do not need Cloud Shell. Nothing in the setup script is specific to it, so the same script runs unchanged in a local PowerShell session:

  1. Install PowerShell 7 (Windows, macOS, or Linux) and open a pwsh session.

  2. Install the Exchange module:

    Install-Module ExchangeOnlineManagement -Scope CurrentUser

    The script also installs it for you if it is missing.

  3. Install the Azure CLI, then sign in:

    az login --allow-no-subscriptions

    Step 1 of the script resolves Outermind's service-principal object id with az, and --allow-no-subscriptions is what lets that sign-in succeed in a tenant that has no Azure subscription. Step 1 checks for a working sign-in before it runs that lookup, so if you skipped this command, or your session has expired, the script says so and points you back here instead of failing with a confusing message.

  4. Copy the same script from the Mailbox Automation page, paste it into the pwsh session, and run it.

  5. Return to the page and click Verify authorization as usual.

Prerequisites, honestly stated. The local path still requires the same Microsoft 365 Global Administrator role the Cloud Shell path requires - the script adds your account to the Exchange Organization Management role group and assigns management roles. It does not require an Azure subscription, an Azure storage account, or any additional license.

The same applies to the Teams meeting-transcript setup script under Manage > Meeting Intelligence: it installs the MicrosoftTeams module itself and never calls Azure, so a local PowerShell 7 session plus a Global Administrator or Teams Administrator sign-in is all it needs. See Teams Meeting Transcript Access for that runbook.

Partly-complete script runs​

If the setup script registered Outermind's service principal in Exchange Online but is missing one or more required roles, the page reports this as partly complete, not as "not run yet" — re-run the script shown on the page to pick up the missing roles.

Re-authorization​

If Outermind later needs additional Microsoft Graph permissions, the consent half can go stale even though it keeps working on the original approval. The page shows a re-authorize action in that case; approving it does not interrupt the mailboxes Outermind has already provisioned.

What happens after both halves are confirmed​

Once both halves are green, Outermind automatically creates and scopes a shared mailbox for each agent that needs one, without any manual steps from a Platform Admin.

If Mailbox Automation is not enabled​

Agent creation is unaffected — agents are still created and still work. Without Mailbox Automation, a Platform Admin provisions each agent's mailbox by hand instead of it happening automatically.

Troubleshooting​

The page says it "could not check" one of the halves​

This means Outermind could not reach Microsoft Entra or Exchange Online just now — it is not a statement that consent or the setup script is missing. Click Re-check to try again.

"Could not load file or assembly" when the script connects to Exchange Online​

The script stops at Step 2 - Connect to Exchange Online with a message like:

Could not load file or assembly '...\ExchangeOnlineManagement\...\Microsoft.Identity.Client.dll'.
The located assembly's manifest definition does not match the assembly reference. (0x80131040)

The ExchangeOnlineManagement module signs in through a Microsoft library called Microsoft.Identity.Client, and so do the Az and Microsoft.Graph PowerShell modules. If one of those already loaded a different version of it into the window you are running the script in - for example because you had just been troubleshooting an Azure sign-in there - the Exchange module cannot load its own copy.

.NET cannot unload a library once it has been loaded, so this window cannot be repaired and re-running the script in it fails the same way. To get past it:

  1. Close the PowerShell window (or the Cloud Shell tab).

  2. Open a new one and paste the script again. In that window, do not run Connect-AzAccount and do not import the Az or Microsoft.Graph modules first - each loads its own copy of the same library. The az CLI is a separate program and is safe to use.

  3. If a fresh window still fails, the cached module itself is mixed. Run:

    Update-Module ExchangeOnlineManagement

    or, if that does not clear it:

    Uninstall-Module ExchangeOnlineManagement -AllVersions
    Install-Module ExchangeOnlineManagement -Scope CurrentUser

    Then open a new window and paste the script again.

Anything the script already finished is safe to repeat. Every step that changes your tenant skips or carries on when the change is already there, so pasting the whole script into the new window picks up where it stopped. The script itself now reports this remedy when it hits the error, and the Mailbox Automation page carries the same guidance under "The script stopped with a 'Could not load file or assembly' error".

Azure Cloud Shell says a subscription is required​

Cloud Shell needs an Azure subscription to store its shell. If your organization is Microsoft 365-only, skip Cloud Shell entirely and follow Running the script without an Azure subscription above - the setup script itself does not need a subscription.

"Mailbox Automation status is not available for your account"​

Approving Outermind's Microsoft 365 applications is handled by a Platform Admin. Ask one of your administrators to enable Mailbox Automation.

I used to use the Exchange Authorization wizard​

That wizard has been retired and no longer has a route. Its runbook is now embedded directly on this page — use Administration > Mailbox Automation instead.

FAQ​

Do I need to complete both halves before agents can be created?

No. Agent creation does not depend on Mailbox Automation. Without it, mailbox provisioning simply falls back to a manual, per-agent process run by a Platform Admin.

What if only the consent half is granted?

Outermind will not report Mailbox Automation as working until the Exchange Online setup script has also been verified. Run the script shown on the page and re-check.

Can I disable Mailbox Automation later?

Revoke the application's consent in Microsoft Entra to stop Outermind from managing mailboxes automatically. Existing agent mailboxes are not affected; new ones fall back to manual provisioning.