Set up Microsoft 365 for your environment

There are two ways to connect Microsoft 365 to your AI-School environment. First choose which route fits your organization.

Route	When	What you do
AI-School central app (default)	Personal connections with Outlook Mail, Outlook Calendar, Teams, and SharePoint/OneDrive.	An Entra admin grants organization consent via Connect Microsoft 365. After that, you enable the integrations as described in step 5 of this article. You do not need your own app, client secret, or Identity Provider.
Your own Entra app	You want to centrally import SharePoint folders into the knowledge base, employees already log in with Microsoft through their own app, or you want to manage the app yourself.	Follow this article starting at step 1.

If your organization already logs in with Microsoft through its own app (the Microsoft ID field of the environment is filled in), then all connections use that own app. The central route does not apply in that case.

Your own Entra app

With your own Microsoft Entra app, your organization can use the same app for Sign in with Microsoft and for Outlook, Teams, and SharePoint. You centrally determine which integrations and write actions are available. Users then only turn their personal connections on or off in Preferences → Tools → Connections.

The personal integrations work with supported models from OpenAI, Claude, Gemini, and Mistral. The selected model must be able to use tools. For personal connections, access follows the permissions of the signed-in Microsoft user. Organization consent does not automatically sign in all employees and does not give the AI independent access to all mailboxes. The central SharePoint knowledge base uses separate app permissions and the existing knowledge base permissions, as described later in this article.

What do you need?

A Microsoft 365 organization with Microsoft Entra ID and accounts with access to the desired services.
An administrator who may register an app and grant organization consent for the chosen Microsoft Graph permissions. An Azure subscription role alone is not sufficient; your Entra role must allow this consent.
Admin rights in the correct AI environment to make integrations available.
A platform administrator who can configure the Microsoft Identity Provider for this AI environment in Google Cloud Identity Platform.
An app registration in your own Microsoft directory, with a client secret and the two redirect URLs of the correct brand.

Signing in with Microsoft and accessing Microsoft data are two separate functions. A working Microsoft login alone does not mean that Outlook, Teams, or SharePoint is configured.

1. Register one organization app

Open the Microsoft Entra admin center and go to App registrations → New registration. Use a recognizable name, for example AI-School – your organization name. For your own organization, choose Accounts in this organizational directory only (Single tenant).

Save the following details from Overview:

Item	What for?
Directory (tenant) ID	Your organization’s Microsoft directory; this goes in the Microsoft ID field of the AI environment.
Application (client) ID	The registered app; this goes in the Microsoft Identity Provider.

These two IDs are different. Do not enter the client ID or the Firebase tenant ID in Microsoft ID.

2. Set the correct redirect URLs

Go to Authentication → Add a platform → Web. Add both of the URLs below for your brand, exactly as shown. The first handles sign-in; the second handles consent for the work account integrations.

Brand	Sign in with Microsoft	Work account integrations
AI-School	`https://ai-school-pro.firebaseapp.com/__/auth/handler`	`https://europe-west1-ai-school-pro.cloudfunctions.net/completeConnectorOAuth`
AI-Corporate	`https://ai-corporate.firebaseapp.com/__/auth/handler`	`https://europe-west1-ai-corporate.cloudfunctions.net/completeConnectorOAuth`
AI-Public	`https://ai-public-pro.firebaseapp.com/__/auth/handler`	`https://europe-west1-ai-public-pro.cloudfunctions.net/completeConnectorOAuth`

Use the URLs of the brand on which your environment runs. Your own organization name or tenant ID does not need to be entered in these URLs. The website URL, dashboard URL, and .web.app URL do not replace these callbacks. Register them as Web, even if you use the integration from a browser. You do not need to enable implicit token issuance or a public client flow for this.

3. Create a client secret and assign permissions

Go to Certificates & secrets → Client secrets → New client secret. Choose an appropriate lifetime and safely store the Value as soon as it is visible. Provide the value through the agreed secure channel for platform administration; the Secret ID is not the client secret. Track the expiration date and replace the secret before that date, including in the Identity Provider.

Then go to API permissions → Add a permission → Microsoft Graph → Delegated permissions. Add only the permissions for the integrations and actions your organization will offer.

Integration	Read permissions	Extra permissions for writing
Profile / basic	`User.Read`; the sign-in flow also requests `openid`, `profile`, `email`, and `offline_access`	None
Outlook Mail	`Mail.Read`	Drafts: `Mail.ReadWrite`. Send: `Mail.Send`.
Outlook Calendar	`Calendars.Read`	Write: `Calendars.ReadWrite`.
Microsoft Teams	`Chat.Read`, `ChannelMessage.Read.All`	Post: `Team.ReadBasic.All`, `Channel.ReadBasic.All`, `ChannelMessage.Send`.
SharePoint / OneDrive	`Sites.Read.All`, `Files.Read.All`	This work account integration does not offer write actions here.

Mail.ReadWrite does not grant sending rights; Mail.Send is required separately. Teams posting writes text messages in a selected channel, not private chat messages. For this integration, use Delegated permissions, not Application permissions. Even for permissions with All in the name, delegated access remains limited by the user’s access.

Click Grant admin consent for your organization and check that the selected permissions show as granted. This allows employees to use the approved access without having to grant organization rights themselves. Microsoft may still ask for sign-in, MFA, or renewed consent depending on your policy.

4. Connect the app in two places to the AI environment

Have the platform administrator select the correct environment and perform these settings:

In Admin → Environment → Tenant: enable the Microsoft sign-in method and enter the Directory (tenant) ID in Microsoft ID.
In Google Cloud → Identity Platform → the relevant tenant → Identity providers → Microsoft: enable the provider and enter the Application (client) ID and the client secret Value of the same Entra app.

The Identity Provider belongs to the Firebase/Identity Platform tenant of your AI environment, not to another organization or the general Admin environment. The work account integration reuses the app from this provider. The client secret does not belong in user preferences, chat messages, or ordinary environment fields.

Provide platform administration with the organization name, brand, Directory ID, client ID, secret value via the secure channel, expiration date, and desired integrations/permissions. An app ID alone is not enough.

5. Enable the integrations and write actions

Open the management environment of your organization → Tools → MCP. Turn on the Microsoft 365 integration under Suite shortcuts. The Microsoft rows become visible; when the entire suite is turned off, those rows remain hidden.

Choose per integration whether it is available. In the Write actions column, choose separately:

Outlook Mail → Drafts: create and modify drafts.
Outlook Mail → Send: actually send an existing draft.
Outlook Calendar → Write: create and modify appointments.
Microsoft Teams → Post: place text messages in a chosen Teams channel.

Click Save. A write action works only if both the integration and the corresponding management permission are enabled, Microsoft has granted the required permissions, and the user has turned on the connection personally. The user does not receive an additional form for write permissions.

Availability

The settings must also be supported by your brand’s backend. This write extension was targeted for release and tested on 7 October 2026 for OnderwijsSupport on AI-Corporate. That does not automatically mean the same extension is already available for AI-School, AI-Public, or any other environment. Ask platform administration to confirm when write actions are missing.

6. Check the setup

Have a user sign in to the correct AI environment and enable the desired integration according to Using Microsoft integrations. Check whether Microsoft displays the name of your own Entra app.

First test a recognizable draft and an appointment without attendees. Check the saved items in Outlook. Then test sending with an agreed test recipient and Teams posting in an agreed test channel. An appointment with attendees can send invitations or updates. An accepted send command is not yet a confirmed delivery.

When permissions are expanded, the connection tries to refresh tokens. If Microsoft requires sign-in or consent again, have the user reconnect the existing connection. No second app or separate user setting needs to be created.

Troubleshooting

Problem	Check
`AADSTS50011` / redirect mismatch	Both callbacks registered exactly as Web, for the correct brand.
A different app name appears during consent	The correct AI environment, Directory ID, and tenant-specific Microsoft Identity Provider; then reconnect.
Login works, but the integration does not	Also check the connector callback, Graph permissions, and organization consent.
Reading works, writing does not	Check management permission, corresponding delegated Graph permission, granted consent, and backend availability.
Client secret invalid or expired	The Value, not the Secret ID; also update the new secret in the Identity Provider.
Integration missing for the user	Check availability in Tools, user permissions for connections, and the selected AI environment.

More information

Central SharePoint knowledge base: set up Microsoft

A centrally connected folder works through the organization app, without each employee enabling a personal SharePoint connection. This requires two separate consents: the application permission Sites.Selected with admin consent, and a read grant on the chosen SharePoint site. A working Microsoft login or admin consent alone is not sufficient.

1. Check the organization app

Use the same single-tenant app registration as for Microsoft sign-in in your AI environment. An existing app can be extended; a second integration app is not needed. In Microsoft Entra → App registrations → your app → Overview, check the Directory (tenant) ID and Application (client) ID. Use the client ID below, not the Object ID.

The Directory ID must be in Admin → Environment → Tenant → Microsoft ID. The client ID and the Value of a valid client secret must be in the Microsoft Identity Provider of exactly that AI environment. This configuration is maintained by platform administration. An expired secret also prevents the central import; keep track of the expiration date.

The central server connection uses client_credentials and does not request an extra redirect URL. The existing Web redirects for sign-in and personal work account integrations remain necessary; use the brand-specific URLs from the table earlier in this article.

Open API permissions → Add a permission → Microsoft Graph → Application permissions.
Search for Sites.Selected, select this permission, and click Add permissions.
Have an authorized Entra administrator perform Grant admin consent for your organization.
Check that Sites.Selected, type Application, is shown as granted.

The delegated permissions for personal Outlook, Teams, and SharePoint connections can remain on the same app. They do not replace the application permission for the central knowledge base. This central import does not require application permissions Sites.Read.All, Sites.ReadWrite.All, or Sites.FullControl.All.

3. Give the app separate read access to the site

This administrative action can be done with Microsoft Graph Explorer. Use an admin account in the same Microsoft directory, with SharePoint Administrator or a higher suitable admin role and access to the relevant site. An Azure subscription role or app ownership alone is not sufficient.

Sign in to Graph Explorer with the admin account and verify the organization shown.
Open your profile menu → Consent to permissions, find Sites.FullControl.All, and choose Consent to grant the required permission for Graph Explorer in this admin context. For some queries, you can also open the full permissions panel via Modify Permissions → Open the permissions panel. This is a delegated admin permission to manage site grants; do not add it as a broad application permission on the knowledge base app. Use account-based consent when organization consent for all users is not needed.
Find the site ID with the GET below. Replace the example host and site path with those of your own folder. For a URL with /teams/, use that path instead of /sites/.

GET https://graph.microsoft.com/v1.0/sites/yourorganization.sharepoint.com:/sites/yoursite?$select=id,displayName,webUrl

The id value in the response is the full site ID, including host name and two GUIDs. Also check displayName and webUrl: the grant must be applied to the site where your folder actually resides.

First check existing grants with GET at the address below. If your client ID is already listed there with role read, you do not need to create a second grant. Have your Microsoft admin review any existing broader or different grants.

GET https://graph.microsoft.com/v1.0/sites/SITE-ID/permissions

If the grant is missing, choose POST, use the same address, and enter the following JSON in Request Body. Replace the two example values; CLIENT-ID-OF-YOUR-APP is the Application (client) ID of your integration app, not the Graph Explorer app.

{
  "roles": ["read"],
  "grantedToIdentities": [
    {
      "application": {
        "id": "CLIENT-ID-OF-YOUR-APP",
        "displayName": "NAME-OF-YOUR-INTEGRATION-APP"
      }
    }
  ]
}

Choose Run query. A successful addition returns 201 Created. Check the read role and client ID in the response; Graph may show this under grantedToIdentitiesV2. Then verify again with GET. Save the permission ID for administration and possible later revocation.
Repeat this only for each other site whose knowledge base folders you deliberately want to connect.

Site grant and knowledge base permissions

The Microsoft grant gives the app read access to the entire selected site. The AI environment only imports the chosen folder and subfolders. Prefer a separate site for centrally shared knowledge. The existing knowledge base permissions determine which users receive the imported documents; individual SharePoint permissions are not inherited.

4. Connect the folder and check the result

Open Administration → Knowledge base → Add → SharePoint folders → Connect folder and use the real folder URL, not an invitation link or OneDrive overview address. Choose scope, audience, and publication status according to the knowledge base guide. A central source does not require a personal connector in user preferences.

Check with Refresh whether the documents were processed without errors. Use Sync now for another check and then ask a concrete chat question about an imported document. Verify that the answer mentions the correct central knowledge source.

Problem	Microsoft-side check
Login works, but the central folder does not	`Sites.Selected` must be of type Application and have admin consent; also check the separate site grant.
`403 Forbidden` when accessing the folder	Correct Microsoft directory, site ID, client ID, and `read` grant; admin consent alone does not grant site access.
`403` for the administrative action in Graph Explorer	Delegated `Sites.FullControl.All`, granted consent, admin role, and access to the target site. Do not add a broad permission to the integration app as a solution.
Site works, folder not found	Check the real folder URL, document library, and site path; a OneDrive shortcut can point to a different site.
Secret expired or invalid	Have platform administration update the new secret Value in the correct Microsoft Identity Provider.

For OnderwijsSupport on AI-Corporate, this central connection was published and tested on 14 October 2026. Availability on AI-School, AI-Public, or another environment must be confirmed by platform administration.

Microsoft documentation: Selected permissions, add site grant, and check site grants.

Your own Entra app​

What do you need?​

1. Register one organization app​

2. Set the correct redirect URLs​

3. Create a client secret and assign permissions​

4. Connect the app in two places to the AI environment​

5. Enable the integrations and write actions​

6. Check the setup​

Troubleshooting​

More information​

Central SharePoint knowledge base: set up Microsoft​

1. Check the organization app​

2. Add the application permission and grant admin consent​

3. Give the app separate read access to the site​

4. Connect the folder and check the result​