> For the complete documentation index, see [llms.txt](https://www.cakewalk.security/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.cakewalk.security/docs/ai-agent-access/connections-and-integrations/agent-connections/microsoft-365-mail.md). # Microsoft 365 Mail Connect your company's Outlook mail to Cakewalk's MCP Gateway through Microsoft's Work IQ Mail server, part of Microsoft Agent 365. Every agent tool call against mail passes through the gateway and is evaluated against your company's Policies. Cakewalk connects through a Microsoft Entra app that your company registers once and reuses for every Microsoft Work IQ connection. Your admin registers the app, grants it the Mail permission, and pastes the Tenant ID, Client ID and secret into Cakewalk. Employees then sign in with their own accounts, so every call runs with that person's own mailbox access. {% hint style="info" %} The Entra app is shared across all Microsoft Work IQ connections. If you already registered it for another Microsoft connection (Calendar, OneDrive, Word, Teams or SharePoint), skip Steps 1 and 2 and go straight to [Step 3](#step-3-add-the-mail-permission). {% endhint %} ## Requirements * A Microsoft 365 Copilot license for every employee who will use the connection. * A Microsoft Entra administrator who can register an app and grant admin consent (Global Administrator, Cloud Application Administrator or Application Administrator). * A Cakewalk Admin who can enable the Connection. ## Step 1: Enable the Work IQ MCP APIs in your tenant (one time) The Work IQ servers must be present in your tenant before you can grant permissions to them. Most tenants need this once. 1. On a machine with PowerShell, download Microsoft's provisioning script: [Enable-WorkIQToolsForTenant.ps1](https://github.com/microsoft/work-iq/blob/main/scripts/Enable-WorkIQToolsForTenant.ps1). 2. Run it and sign in with an account that has Entra admin rights and a Microsoft 365 Copilot license. If the Work IQ APIs already appear when you search in Step 3, you can skip this. ## Step 2: Register the Cakewalk Entra app (one time) 1. Go to the [Azure portal](https://portal.azure.com) and open **Microsoft Entra ID**. 2. Go to **App registrations** and select **New registration**. 3. Give it a name, for example `CakewalkMcpClient`. 4. Under supported account types, select **Accounts in this organizational directory only** (single tenant). 5. Under **Redirect URI**, choose type **Web** and enter: ``` https://mcp-gateway.getcakewalk.io/api/v1/Auth/Callback ``` 6. Select **Register**. 7. Open **Overview** and copy the **Application (client) ID** and the **Directory (tenant) ID**. 8. Open **Certificates & secrets**, select **New client secret**, give it a name and expiry, and copy the secret **Value** now. You cannot read it again later. ## Step 3: Add the Mail permission In the same Entra app: 1. Open **API permissions**, select **Add a permission**, then **APIs my organization uses**. 2. Search for **Agent Tools**. If nothing appears, search for its app ID `ea9ffc3e-8a23-4a7d-836d-234d7c7565c1`. If it still does not appear, the Work IQ APIs are not enabled in your tenant yet: complete Step 1 first. 3. Select the delegated permission **`McpServers.Mail.All`** and add it. 4. Select **Grant admin consent**. This is the only step that differs per Microsoft Work IQ connection. To add Calendar, OneDrive, Word, Teams or SharePoint later, reuse the same app and grant that connection's scope here (`McpServers.Calendar.All`, `McpServers.OneDrive.All`, `McpServers.Word.All`, `McpServers.Teams.All`, `McpServers.SharePoint.All`). ## Step 4: Connect from Cakewalk 1. Sign in to Cakewalk as an Admin at . 2. Go to **All Connections** and select **Add org connection > Choose from catalog**. 3. Select **Microsoft 365 Mail**. 4. Enter the **Directory (tenant) ID**, **Application (client) ID** and **client secret** you copied in Step 2. ## Verifying it works From an agent platform connected to Cakewalk, ask the agent to summarize your latest emails. If Outlook Mail returns results, the connection is live. In Cakewalk, the Microsoft 365 Mail card on **All Connections** shows as active. ## Learn more * [Work IQ Mail reference](https://learn.microsoft.com/en-us/microsoft-copilot-studio/mcp-mail-work-iq) from Microsoft. * [Work IQ MCP overview](https://learn.microsoft.com/en-us/microsoft-agent-365/tooling-servers-overview) from Microsoft. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.cakewalk.security/docs/ai-agent-access/connections-and-integrations/agent-connections/microsoft-365-mail.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.