Microsoft Outlook Mail MCP Tools for AI Agents
Let an agent search Outlook mail, read messages and attachments, organize folders, draft replies, and send email from user or shared mailboxes.
Available Tools
57 tools available in this integration
Why agent-optimized tools matter
Built for intent, not API schemas
Ask the agent to "find the latest customer thread about a delayed order and draft a reply." Arcade picks the right Outlook Mail actions without guessing message IDs or folder IDs.
Up to 100x fewer tokens
Outlook Mail listings and searches return message metadata before the agent fetches a full message, so it can narrow a busy inbox without loading every message body into the model.
Complete the workflow end to end
Search a conversation, read the relevant message, create a draft, request approval, and send the response through one toolkit designed around the complete email task.
Make actions predictable and controlled
Arcade tools return structured results and useful errors across users and runs. Teams can apply scope restrictions, redaction, and approval policies so agents follow the same controls every time.
Securing Microsoft Outlook Mail
The more capabilities agents get, the more useful they are. However, more capabilities bring more risks of undesired effects such as data loss and exfiltration.
This is why Arcade provides you with contextual rules that dictate how and when a tool is allowed to run. Arcade’s contextual access lets you govern tool visibility and behavior at every stage of execution and control who can see a tool, what inputs are allowed, and what comes back.
For Microsoft Outlook Mail, you can implement some of these policies:
Access
- Hide MicrosoftOutlookMail.DeleteMailRule from agents without a mailbox-administrator role, so they cannot remove filters that route, delete, or quarantine incoming messages.
- Limit MicrosoftOutlookMail.SaveMailRule to agents operating under the roles your IDP marks as inbox-policy administrators, so unapproved automation cannot create rules that redirect or discard mail.
- Hide MicrosoftOutlookMail.SendMessage from agents without an approved outbound-communications role, so they cannot send new messages to external recipients.
- Restrict MicrosoftOutlookMail.DeleteCategory to mailbox-taxonomy administrators, so agents cannot remove labels used for retention, incident response, or active-work tracking.
- Deny MicrosoftOutlookMail.CreateSharedMailboxMailFolder to agents without delegated-mailbox administration roles, so they cannot alter the folder structure used by a team inbox.
- Hide OutlookMail.CreateAndSendEmail from agents unless they operate under your approved outbound-communications role, so they cannot compose and deliver unsolicited mail.
- Restrict OutlookMail.ReplyToEmail to agents serving approved support or account-management roles, so untrusted workflows cannot answer people from your mailbox.
- Limit OutlookMail.SendDraftEmail to agents whose role permits external correspondence, so a prepared message cannot be sent without the right authorization.
Pre-execution
- Require human approval before MicrosoftOutlookMail.DeleteMailRule runs, so an agent cannot remove a rule that protects billing, security, or compliance messages without review.
- Block MicrosoftOutlookMail.SaveMailRule when a rule forwards mail outside your approved domain list or moves it to a deletion folder, so incoming messages cannot be silently disclosed or discarded.
- Require human approval before MicrosoftOutlookMail.ReplyToMessage runs, so an agent cannot commit an unreviewed response to a customer or colleague.
- Block MicrosoftOutlookMail.SaveDraft when the draft includes external recipients or restricted attachments, so sensitive content cannot be staged for unauthorized delivery.
- Refuse MicrosoftOutlookMail.SendSharedMailboxMessage when a recipient falls outside your approved domain list, so a team address cannot send internal correspondence to an unverified destination.
- Require human approval before OutlookMail.CreateAndSendEmail runs, so an agent cannot send a new message to customers, vendors, or other external recipients unprompted.
- Refuse OutlookMail.ReplyToEmail when the reply contains credentials, access tokens, or confidential customer details, so private information cannot be published in an existing thread.
- Block OutlookMail.SendDraftEmail when any recipient is outside your approved domain list, so a saved draft cannot become an unauthorized external message.
Post-execution
- Redact mailbox addresses, forwarding destinations, folder names, and rule conditions from MicrosoftOutlookMail.ListMailRules results before they reach the model, so routing logic and private correspondence paths remain hidden.
- Redact message bodies, attachment names, sender and recipient addresses, and phone numbers from MicrosoftOutlookMail.ListMessages results before they reach the model, leaving only metadata needed to triage mail.
- Strip message content, signatures, and personal contact details from MicrosoftOutlookMail.QueryMessages results, so an inbox search cannot expose private correspondence beyond the fields needed to identify matching messages.
- Deny MicrosoftOutlookMail.ListSharedMailboxMessages output for messages marked Confidential or subject to legal hold, so protected team-mailbox content never reaches the model.
- Redact sender addresses, recipient addresses, and subject lines from MicrosoftOutlookMail.ListUnansweredConversations results before they reach the model, so the agent can identify pending work without seeing participants or topic details.
- Strip full message bodies, quoted history, and signature blocks from OutlookMail.GetEmail results before the model sees them, so opening one private message does not expose its correspondence.
- Redact attachment names and content identifiers from OutlookMail.ListEmailAttachments results, so an agent can see that files exist without learning confidential filenames or storage references.
How to use Microsoft Outlook Mail with your agent
Pick your MCP client below and follow the setup to connect an agent to Outlook Mail. Each end user authorizes their own mailbox.
Your questions, answered
A Microsoft Outlook Mail MCP server exposes Outlook mailbox capabilities as structured tools that an AI agent can call through the Model Context Protocol. After a user authorizes their Microsoft account, the agent can perform permitted actions such as searching mail, reading messages, creating drafts, and sending email.
Arcade provides an MCP endpoint for Outlook Mail with user-level OAuth, agent-optimized actions, approval workflows, redaction, and scope controls. It also covers shared and delegated mailboxes, so teams can govern mailbox actions consistently across agents and clients.
Arcade agents can search, list, and read messages; create, update, send, reply to, and forward email; work with drafts and attachments; manage folders, categories, read state, and follow-up flags; create Inbox rules; configure automatic replies; and operate on reachable shared or delegated mailboxes.
Arcade requests the Microsoft Graph permissions required by the actions you enable. Read-only mail workflows need mail-read access, changing messages, folders, categories, or rules needs mail read/write access, sending needs mail-send access, and automatic-reply settings need the corresponding mailbox-settings permissions; shared-mailbox actions require the applicable shared-mail permissions. Grant only the permissions your workflow needs.
Yes. Each user authorizes their own Microsoft account through OAuth. Actions run under that user's authorization, so the agent can access only the mailbox and permissions that user approved, including any shared or delegated mailboxes they can reach.
Yes. Contextual Access policies can require human approval before consequential Outlook actions such as sending, forwarding, moving, deleting, changing Inbox rules, or updating automatic replies. The call proceeds only after the policy's conditions have been satisfied.
Arcade proxies Outlook API calls and does not persist your message content as part of normal tool execution. OAuth credentials are brokered and stored encrypted at rest, and the model never receives raw credentials.
Any framework or client that can connect to Arcade's MCP gateway or tool APIs works, including LangChain, OpenAI Agents, CrewAI, Claude Desktop, Claude Code, Cursor, Visual Studio Code, Microsoft Copilot Studio, and GitHub Copilot.
Arcade refreshes access while the user's Microsoft authorization remains valid. If access is revoked, rotated, or can no longer be refreshed, Outlook actions stop until the user reconnects their account.
Microsoft Graph throttling, Outlook mailbox limits, and account-level sending limits still apply to calls made through Arcade. Shared-mailbox actions also depend on the delegated access and mailbox APIs available to the user; there are no separate Arcade limits that replace Microsoft's quotas.