Microsoft 365 App Authorizations
Authorize Outermind's Microsoft 365 applications so agents can use the mail, calendar, files, Teams, and other capabilities your organization enables.
Overview
Outermind uses separate Microsoft Entra applications for distinct capabilities. This lets your organization approve only the capabilities it needs. The core application, Outermind - Mail & Calendar, is required for agent mail, calendar, contacts, and directory-based message routing. Other applications are optional and are authorized from their own capability pages.
When an agent needs an application that is not authorized, Outermind removes the affected tools before the execution begins. If the missing authorization prevents a transport-specific task from completing, the execution finishes without attempting a tool call that would fail. Platform Admins receive an in-console alert that identifies the affected agent and links to the authorization page.
Responding to an authorization alert
- Select the notification bell in the console header, then open the authorization alert in Support > Messages.
- Review the agent name and the Microsoft 365 application named in the alert.
- Select Authorize in Settings. The action opens the relevant Microsoft 365 authorization page.
- On the authorization card, review the application status and select Authorize in Microsoft 365.
- Sign in to Microsoft and approve the requested permissions. This requires a Microsoft 365 Global Administrator or Privileged Role Administrator.
- Return to Outermind and select Verify now. The card shows Authorized when Microsoft confirms the grant.
If you do not hold one of the required Microsoft roles, copy the consent link from the card and send it to the administrator who does. After they approve it, return to the card and select Verify now.
Core Permissions
The alert for Outermind - Mail & Calendar opens Administration > Core Permissions (/administration/permissions/core). This required application enables agents to read and send mail, work with calendars and contacts, and perform directory lookups used for message routing.
The page shows a status card for the application:
| Status | What it means | What to do |
|---|---|---|
| Not authorized | Microsoft has not granted the application for your tenant. | Select Authorize in Microsoft 365, then select Verify now after approval. |
| Re-authorization needed | Outermind requires permissions that were added after the previous approval. | Review the listed changes, re-authorize, then verify. |
| Authorized | The current authorization was verified with Microsoft. | No action is needed. |
| Verification failed | Outermind could not confirm the status with Microsoft. | Select Verify now again. This does not mean the grant was removed. |
Important: A missing Core Permissions grant prevents agents from using mail-based capabilities. Complete the authorization before expecting those workflows to run.
Foundry application authorization
Outermind - Foundry (App H) is an optional application for access to your organization's Azure resources. It is not required during onboarding and does not prevent you from continuing once Core Permissions are authorized.
-
Open the authorization hub at
/authorizationand follow the Foundry link when it appears among outstanding applications. You can also open/authorization?app=foundrydirectly. -
Review the Outermind - Foundry card and its Azure role table. The table lists the roles used for the resources your organization chooses:
Role Resource Cognitive Services User Foundry account Search Service Contributor Azure AI Search service Search Index Data Contributor Azure AI Search service Storage Blob Data Contributor Storage account Storage Table Data Contributor Storage account -
Select Authorize in Microsoft 365 to approve the application identity in your organization's tenant. This application requests no API permissions. The approval link does not assign the Azure roles listed in the table.
-
If another administrator must approve it, use Copy link to send. The copied message includes the separate Azure role requirements so the recipient can review both parts of setup.
-
Return to the card and select Verify now to check the identity approval.
The card tracks Azure resource access separately from Entra approval. Resource access remains pending until a connected Azure resource has been verified. Approving the identity alone does not make resource access complete; Azure role assignments must be made separately at the resources you choose.
If verification reports that the token belongs to a different tenant, confirm that the approval was completed in your organization's Microsoft tenant before trying again.
Notification behavior
The authorization alert is sent to active Platform Admins when Outermind first detects that an agent needs an unauthorized application. To avoid repeated notifications while the same issue is being addressed, Outermind limits alerts for the same tenant and application to once per administrator in a 24-hour period.
After the application is authorized, the alert condition clears. If authorization is later revoked, a new alert can be sent when an agent needs the application again.
Frequently asked questions
Does the alert mean an agent execution failed?
Not necessarily. Outermind checks the agent's available tools before execution and excludes tools that depend on the missing application. Most agents can continue with their remaining tools. A transport-specific trigger that cannot work without the missing tool completes cleanly instead of failing at the final tool call.
Why did I receive an alert instead of the person who configured the agent?
Microsoft tenant-wide consent is an administrative action. The alert is sent to Platform Admins so the people able to authorize the application can act directly.
I authorized the application, but the alert is still visible. What should I do?
Open the alert, select Authorize in Settings, and use Verify now on the authorization card. Microsoft consent can take a short time to propagate. If verification continues to fail after a few minutes, refresh the page and try again.
Can I ignore an authorization alert?
Yes, if your organization intentionally does not use the affected capability. Agents will not use tools that require the unauthorized application. Leave the application unauthorized only when that limitation is acceptable for the affected workflows.
Does Foundry approval grant access to all our Azure resources?
No. Entra approval establishes the application identity. Azure roles provide access separately at the selected resources. The role table describes the access required; the consent link does not grant those roles.
Why is Azure resource access pending after Foundry approval?
Identity approval and connected-resource verification are separate checks. The resource-access step stays pending until a connected resource is verified. Repeating Entra approval does not complete that step.