VantegrateNative API integrationIntegrate Microsoft 365 with AI agentswith access scoped to each mailbox and site
Vantegrate's AI agents connect to Microsoft 365 through Microsoft Graph, with permissions your admin approves: they read the shared mailbox where invoices arrive, book meetings on each rep's Outlook calendar, file documents in SharePoint and log the outcome in Salesforce. Access is limited to the mailboxes and sites you define, and your data stays in your organization.
How the data flows
What does it mean to integrate Microsoft 365 with Vantegrate's AI agents?
Integrating Microsoft 365 with Vantegrate's AI agents means the agent works with your Outlook mail, your calendars and your OneDrive and SharePoint files through Microsoft Graph, using an app registered in Microsoft Entra ID with permissions your admin approves. Access is scoped to specific mailboxes and sites, and your information keeps living in your organization.
It doesn't replace Microsoft Copilot. Copilot helps each licensed employee inside Word, Outlook or Teams; the agent serves your customers on WhatsApp, SMS or web chat, who have no account in your tenant, and uses Microsoft 365 as its desk: it checks calendars, files documents and logs the conversation in Salesforce or your ERP.
What do you want to connect to your Microsoft 365?
Pick what you need and we'll write the message for you.
1 · Pick what to solve
2 · What our team receives
Vantegrate
online
What moves between the agents and your Microsoft 365
The agent works on three Microsoft Graph surfaces, each with its own permission and a scoped reach.
Mail from a shared mailbox
The agent subscribes to Microsoft Graph change notifications on the mailbox where invoices or purchase orders arrive; when a message lands, it reads it with its attachment and processes it.
Your team's Outlook calendars
It checks the rep's availability and creates the event on their calendar, with the invitation to the customer and, for virtual meetings, a Teams link.
Files in SharePoint and OneDrive
It files the processed document in the right SharePoint library and reads the workbooks your team keeps there, only in the sites it has been granted.
How the integration works, step by step
Vantegrate handles the setup. Your admin approves the permissions and your team validates.
An app in Microsoft Entra ID
We register an app in your organization and request only the Microsoft Graph permissions the use case needs: reading a mailbox, writing to calendars or filing in a site.
Admin consent
Only a Global Administrator or a Privileged Role Administrator can consent to application permissions. Without that step, nothing is enabled.
Scope per mailbox and per site
We scope the app to the defined mailboxes with RBAC for Applications in Exchange Online, and to the assigned SharePoint sites with Sites.Selected.
Pilot and phased rollout
We test with one mailbox and one site, validate what the agent reads, books and files, and add mailboxes gradually.
Microsoft Graph with application permissions, scoped to each mailbox and site
An agent that works with no one signed in uses Microsoft Graph application permissions, and Microsoft is clear about their reach: a permission like Mail.Read, granted to the whole organization, can read any mailbox. That's why only a Global Administrator or a Privileged Role Administrator can consent to it, and why it shouldn't stay open.
In Exchange Online, the way to scope it is RBAC for Applications, which replaces Application Access Policies: the permission is assigned with a scope, such as a group of mailboxes or an administrative unit (Microsoft Learn).
In SharePoint and OneDrive, the equivalent is Sites.Selected: the app starts with no access to any site, and your admin grants it a read or write role site by site. The agent can file in the purchasing library and still can't open the HR one.
This is the part security teams ask about first. In Okta's Businesses at Work report, 58% of organizations name AI governance and identity and access management as their top concern (Okta), and the same report ranks Microsoft 365 first among apps by number of customers. Scoping by mailbox and by site turns that concern into something your admin can review: a list of mailboxes, a list of sites and a log of what the agent did.
| Agent task | Microsoft Graph permission | How it's scoped |
|---|---|---|
| Read invoices in the shared mailbox | Mail.Read (application) | RBAC for Applications, that mailbox only |
| Get notified of each new message | Graph subscription with Mail.Read | Up to 10,080 minutes; the agent renews it |
| Check availability and book | Calendars.ReadWrite (application) | RBAC for Applications, sales team only |
| File the document | Sites.Selected (application) | Write role on the assigned site only |
| Read the quota workbook | Sites.Selected (application) | Read role on that site only |
Permissions per the Microsoft Graph documentation; changes to RBAC for Applications can take 30 minutes to 2 hours to apply. The final scope is set with your admin.
A detail that's easy to miss: RBAC for Applications adds to whatever was granted in Microsoft Entra ID. If the app keeps an organization-wide Mail.Read, the scoping has no effect, so we remove the open grant when we set it up.
Microsoft Copilot, Microsoft's MCP servers and the agent: who does what
Microsoft 365 Copilot, which Microsoft's documentation also calls Microsoft Copilot, helps each employee inside Word, Excel, Outlook and Teams, and only surfaces data that person can already see. It's licensed per user, as an add-on to a qualifying Microsoft 365 plan (Microsoft). Copilot Chat, the web-grounded chat experience, is included at no additional cost for Microsoft Entra users with an eligible Microsoft 365 subscription. Both are built for your employees.
The agent covers a different job: the conversation with the customer, who has no license and no account in your tenant, and it works in Microsoft 365 with an identity of its own to book, file and look things up. The two work side by side: your rep can use Copilot to prepare for the meeting the agent booked.
Microsoft also publishes official MCP servers. Work IQ, its remote server with access to mail, calendar, files, chats and sites, was announced as generally available with usage-based billing; it's read-only unless an admin turns on write operations, and its permissions are delegated: every action runs on behalf of a person. The app-specific mail, calendar and SharePoint servers are listed as previews.
That design is built for each employee's assistant. An agent that acts for the company, with no one signed in, uses Microsoft Graph with its own app and the per-mailbox and per-site scoping above, so we evaluate MCP case by case rather than assume it.
Where each piece ends up: the meeting on the rep's Outlook calendar, the document in SharePoint and the conversation in Salesforce, with links between them. Each tool keeps doing its job on its own data.
You've seen how it connects. Want to walk through your case?
Tell us how your Microsoft 365 is set up and we'll tell you what data we need and where the agent connects.
An agent connected to your Microsoft 365 vs. a standalone tool
| Standalone AI tool | Agent connected to your Microsoft 365 | |
|---|---|---|
| Data source | A copy that drifts | Your Microsoft 365 and your systems, live |
| Where your data lives | In a third-party system | In your Microsoft 365, your CRM and your ERP |
| Result of each operation | Stuck in another app | The event in Outlook, the file in SharePoint and the record in Salesforce |
| Permissions and audit | Broad and hard to audit | Scoped per mailbox and per site, with a log of every action |
| Reaching production | Often stalls as a pilot | Validated, phased rollout |
Microsoft 365 by the numbers
Three third-party figures to size the case. None of them measures a Vantegrate result.
#1
Microsoft 365's rank among the most popular apps by number of customers, ahead of Google Workspace, AWS and Salesforce
#13
Microsoft Outlook's rank in Zapier's app directory sorted by popularity, out of more than 9,000 apps
58%
Of organizations name AI governance and identity and access management as their top concern
Okta ranks apps by how many of its customers use them, worldwide. Zapier sorts its directory by popularity, not counting its own featured product, and doesn't publish usage counts.
Which agents work with your Microsoft 365
Each one uses only the permission its task needs.
Sellium
Sales agent: when a qualified lead asks for a meeting on WhatsApp, SMS or web chat, it checks the rep's availability in Outlook, books the event with the customer invitation and logs the conversation in Salesforce.
Explore Sellium
Metrix
Data agent: adds the Excel workbooks your team keeps in SharePoint as a source, read with read-only access to the approved site, and answers plain-English questions with those figures.
Explore Metrix
Arconte
Document agent: picks up the invoices and purchase orders that arrive in the accounts payable shared mailbox, extracts and validates the data, loads it into your ERP and files the PDF in SharePoint.
Explore ArcontePermissions your admin approves, scoped to what the agent uses
Every application permission is approved by an admin and scoped to specific mailboxes and sites. The agent works inside your Microsoft 365 and leaves the outcome in your systems.
- Connection through Microsoft Graph with an app registered in Microsoft Entra ID; only an admin in your organization can consent to application permissions.
- Least privilege: RBAC for Applications limits the agent to the defined mailboxes, and Sites.Selected to the assigned SharePoint sites.
- Mail, events and documents stay in your Microsoft 365, the outcome is logged in your CRM or ERP, and every action the agent takes is traceable.
- The agents run on Salesforce or Oracle Cloud Infrastructure, whose SOC 2 and ISO 27001 certifications belong to those platforms, not to Vantegrate or Microsoft 365.
Frequently asked questions about the Microsoft 365 integration
What Microsoft 365 admins and security teams ask before granting permissions to an agent.
How do I integrate Microsoft 365 with an AI agent?
How do I integrate Microsoft 365 with an AI agent?
Through an app registered in Microsoft Entra ID that calls Microsoft Graph with application permissions your admin approves. We scope it with RBAC for Applications to the mailboxes it needs and with Sites.Selected to the assigned SharePoint sites, and the agent learns about new mail through Graph change notifications. Vantegrate handles the setup and your team validates it with a pilot mailbox. See how Arconte processes the documents.
Can the agent read every email in the company?
Can the agent read every email in the company?
Not if the permission is scoped. An application Mail.Read granted to the whole organization can read any mailbox, so we assign it with RBAC for Applications only on the right shared mailbox and remove the open grant in Microsoft Entra ID, because the two add up. Microsoft notes that changes take 30 minutes to 2 hours to apply. More detail on our security page.
How does the agent book a meeting on a rep's Outlook calendar?
How does the agent book a meeting on a rep's Outlook calendar?
With getSchedule, which returns the rep's availability, working hours and time zone, and accepts application permissions. With that, the agent offers times in the customer's time zone and creates the event on the rep's Outlook calendar; Microsoft Graph sends the invitation and can add a Teams link. findMeetingTimes, the API that suggests times, only supports delegated permissions. See how WhatsApp demo booking works.
Do I need Microsoft 365 Copilot to use the agents?
Do I need Microsoft 365 Copilot to use the agents?
No. The agent uses its own app registered in your organization and the Microsoft Graph permissions your admin approves, with no Copilot licenses. Copilot is licensed per employee and helps inside Word, Outlook or Teams; the agent serves your customers. They work side by side: what the agent books or files lands in Outlook and SharePoint, where Copilot can find it with each person's permissions.
We already use Salesforce's Outlook integration. Is this the same thing?
We already use Salesforce's Outlook integration. Is this the same thing?
No, the two complement each other. Salesforce's Outlook integration and Einstein Activity Capture bring your reps' existing email and meetings into Salesforce: with Einstein Activity Capture, emails and events reps send and receive are added to the activity timeline of related records (Trailhead). The agent works one step earlier: it talks to the customer, books the meeting and logs the conversation. We agree with your admin which tool records each meeting, so nothing is logged twice.
Microsoft Teams integration
Alerts with context and business answers in channels and chats, through a bot your admin approves.
Learn moreArconte, the document agent
How it extracts, validates and loads into your ERP the invoices and purchase orders that arrive by email.
Learn moreWhatsApp demo booking
How the agent sets up the meeting with the customer and puts it on the rep's calendar.
Learn moreLet's connect AI agents to your Microsoft 365
Tell us which mailboxes, calendars and libraries the agent should touch, and we'll show you which permissions it requests, how they're scoped and what your admin needs to approve. A 30-minute conversation, no commitment.
Francisco Morales, co-founder, takes your call. We reply on WhatsApp within 4 business hours, no strings attached.
