Microsoft integrations
Choose the Microsoft 365 account, credential type, and Mobius manager for mail, calendar, and file work.
A Microsoft integration connects a Microsoft 365 account to Mobius so assistants can read and write what that account can reach, and so Mobius records an event when something there changes.
Read this page before you connect your first Microsoft provider. The providers share one Entra application and related consent, but their available connection types differ. The provider pages cover what each one actually does.
There are two authorization types. With delegated access, one person signs in and every call acts as that Microsoft account. With application access, a Global Administrator approves Mobius for a mailbox the company owns, with no signed-in person in the middle.
Provider map
| Provider | Connects | Use when |
|---|---|---|
| Outlook | One person's Microsoft 365 mailbox, or a mailbox the business owns | An assistant should read, draft, send, file, or reply to mail, or react to mail arriving. |
| Outlook Calendar | A person's or business-owned Microsoft 365 calendar | An assistant should read or book meetings, or react when a meeting changes. |
| OneDrive | One person's OneDrive and the SharePoint libraries it can reach | An assistant should read or write files, or react when a file changes. |
| Microsoft Teams | Your whole Microsoft 365 tenant, through the Mobius bot | People should get their Mobius notifications as direct messages in Teams. |
Connect the provider that owns the thing the assistant needs. Mail, calendar, and files are separate connections even for the same person, because they are separate Microsoft permissions and separate change subscriptions.
Microsoft Teams works differently from the other three. It uses a bot that a Teams administrator installs, not the Entra application and consent this page describes, so the rest of this page doesn't apply to it. Start with the Microsoft Teams page instead.
One app registration, one grant per person
Mobius reaches Microsoft through a single application registered in Microsoft Entra, the directory behind a Microsoft 365 tenant. Entra records consent once per person for that whole application, not once per Mobius provider. So the first Microsoft connect a person makes is the one that asks for permission, and their later ones ride on the same grant.
Two consequences are worth knowing before you connect anything:
- Connecting a second Microsoft provider often skips straight past the consent screen. Nothing is wrong; the grant already covers it.
- Disconnecting one Microsoft integration in Mobius does not revoke that grant. It removes the stored credential and takes down that connection's change subscription, and leaves the person's other Microsoft connections working. To withdraw the authorization itself, remove Mobius from My Account > Privacy in Microsoft, or have an administrator remove it in the Entra portal.
We would rather leave the grant in place than have a calendar disconnect silently break the same person's mailbox.
Application consent stays in the tenant until an administrator removes it there. This Microsoft consent is separate from the Mobius account grant that lets a selected assistant use one exact connection.
Your administrator may need to approve Mobius first
Mail, calendar, and file access are not among the permissions a Microsoft 365 tenant hands out on an individual's say-so. In a tenant configured the default way, the first person to connect sees a message telling them to ask an administrator, and nobody can connect until an administrator approves Mobius once for the whole tenant.
That approval is a one-time step per tenant, not per provider or per person. After it, everyone connects on their own and the consent screen stops appearing.
Choose the account and its manager
Microsoft always shows the account chooser, even when the browser is already signed in to a work account. Pick deliberately: the account you choose is the one every action runs as.
For delegated sign-in, the account choice defaults to My account. An organization administrator can choose Shared account before connecting for a mailbox the team shares. A team member's own account can only be connected as theirs. The selected Microsoft identity still determines whose mail, calendar, or files every call can reach.
Connecting a second account adds a second connection rather than replacing the first, and reconnecting refreshes the connection that account already has. Mobius matches on the account's Entra object ID rather than its address, so a name, sign-in, or email-domain change keeps the connection intact.
After connecting, open the account's Assistant access section and grant it to selected assistants. A personal grant limits use of the account and retention of its tool results to the manager's Mobius audience. A team-managed account can be available to the team or named people. This Mobius grant is required even when Microsoft consent already exists; it does not inspect an email recipient, meeting attendee, or other destination supplied to an action.
The two credential planes
A plane is which credential the connection runs on. Mobius supports two, and they behave differently on the questions that matter to a business.
| Authorization | How it connects | Acting identity | Mobius manager |
|---|---|---|---|
| Delegated | A person clicks Continue with Microsoft and signs in. | The Microsoft account that signed in | My account by default, or Shared account when an organization administrator chooses it |
| Application | A Global Administrator approves Mobius for the tenant and the request names a mailbox. | The named mailbox, with no signed-in person. It can't be a team member's own mailbox | Team |
Start with delegated access when the work should act as one person. Use an application connection for a company mailbox that must keep working after a staff change. The app-only plane is available for Outlook and, through the API, Outlook Calendar. Calendar application connections accept tenant proof from a prior delegated Outlook or Outlook Calendar connection; Outlook mail requires a prior Outlook connection.
OneDrive remains delegated-only. Outlook Calendar application access is available through the API, while its current app page offers delegated sign-in.
A tenant is one company's Microsoft account boundary: its people, mailboxes, and administrators. Mobius will only connect a business mailbox in a tenant your organization has already proven it belongs to, and the proof is somebody signing in with Microsoft first. Without that check, a typed-in tenant ID would let one customer point a connection at another company's directory.
What admin consent asks for
An app-only connection sends a Global Administrator of your tenant to a
Microsoft consent screen. It asks to grant the application permissions configured
for Mobius: mail
connections need Mail.ReadWrite and Mail.Send; calendar connections need
Calendars.ReadWrite. Application permissions carry
no signed-in user, which is exactly why the connection keeps running overnight,
and also why the grant is broad: on its own it reaches every mailbox in the
tenant.
Mobius only ever addresses the mailbox the connection names. The token is wider than that, so narrow it in Microsoft as well.
The administrator often is not the person who started the connection. In that case Microsoft records the consent, and Mobius shows the administrator Consent recorded with a link to send back. The person who started the connection opens that link while signed in to Mobius, within 24 hours, and the connection finishes. Only that person can finish it.
Narrow an application permission to specific mailboxes
Your IT administrator scopes the grant with Exchange RBAC for Applications, a PowerShell change in Exchange Online that limits which mailboxes an app registration can open. Point it at the shared mailboxes you actually connected. Microsoft's guide is limiting application permissions to specific mailboxes.
We recommend doing this during the first connection rather than filing it as hardening. It is a short change, and it is the difference between "the assistant can read the support inbox" and "the assistant can read the whole company's mail".
The unverified publisher warning
An administrator consenting to Mobius may see a warning that the app is not published by Microsoft or by their organization. That is Microsoft's publisher verification, which we are still completing. An administrator can read the permissions and proceed, and the connection works normally afterwards. Expect to explain the warning to an IT contact who has not met you.
Change subscriptions and delivery gaps
Microsoft pushes changes to Mobius rather than making us poll for them. On connect, each provider asks Microsoft Graph for a change subscription and records where things stood at that moment.
Graph expires a subscription on a schedule of its own, and a lapsed one cannot be extended, only replaced. Mobius therefore renews each subscription with hours to spare rather than at the last moment, and checks on a schedule of a few minutes.
When a subscription does have to be replaced, deliveries were missed in the meantime and Graph never resends them. Mobius replays the change history from the point it recorded instead, so the missed changes still arrive as events. One pass replays only so much, and each provider page says what happens when a gap is bigger than that.
Choose an account during work
When an assistant has several Microsoft accounts, name the account in the request or save an Account preferences choice for Your chats or Channel replies. A routine saves its own exact accounts. Mobius does not substitute a team connection merely because it exists.
Read Connect accounts for account preferences, result audiences, reconnecting, and disconnect consequences.
Next
- Connect Outlook for mail actions and mail events.
- Connect Outlook Calendar for meetings and free/busy.
- Connect OneDrive for file actions and change events.
- Manage connected accounts and assistant access in Connect accounts.