Integrations

An Outlook integration connects a Microsoft 365 mailbox to Mobius. Agents can list and search what is in it, read one message in full, send a message or reply in the thread, leave a draft for a person to check, mark something read, and list the mailbox's folders. When mail lands in the watched folder, Mobius records a source event that a routine or trigger can react to.

A ticket email reaches the support address at 2am. You want an agent to read it, look up the customer, and leave a drafted reply for whoever opens the queue at 8am. Outlook is the connection that makes both ends of that possible: the arrival is the event, the draft is the action.

For the sign-in, consent, and disconnect rules this provider shares with the rest of the Microsoft 365 family, see Microsoft integrations.

Capability map

Connect Outlook

A mailbox belongs to the person who connected it. Connecting a second account adds a second connection rather than replacing the first, and Mobius matches reconnects on the account's Entra object ID rather than its address, so a rename or a domain migration keeps the connection intact. The account chooser always appears: the account you pick is the one every action runs as.

On connect, Mobius subscribes to the account's inbox and records where the folder stood, so a later outage has a point to catch up from. The inbox is the only folder a connect flow watches. Actions can read any folder the account can see, but only inbox arrivals raise events.

Your Microsoft administrator may have to approve Mobius once for the whole tenant before anyone can connect. See administrator approval.

Connect a mailbox the business owns

A mailbox like support@ or billing@ belongs to the company, not to a person, and connecting it through someone's sign-in makes it theirs: it stops working when they leave. Mobius can instead connect such a mailbox on the organization's own grant, so nobody's account is in the middle of it.

This mode is API-only today. The app's Connect button always runs the personal sign-in flow.

{
  "auth_mode": "application",
  "mailbox": "support@northwind.example",
  "owner": { "kind": "org_shared" }
}

Post that to POST /v1/integrations/providers/outlook/connect and send a Microsoft Global Administrator to the returned consent URL. Three things are worth knowing before you try it:

• Your organization needs one ordinary Microsoft sign-in connection first. That is what establishes which Microsoft directory you belong to, and an app-only connection is only ever granted into a directory you have already proven.
• owner must be org_shared, and creating an org-shared connection is an organization-admin action. The request is refused rather than quietly making the connection somebody's.
• A mailbox already connected one way cannot be flipped to the other. Disconnect the existing connection first.

Permissions

Mobius requests Mail.ReadWrite, which covers reading mail, creating drafts, marking messages read, and the change subscription. Mail.Send covers sending. User.Read is what makes the mailbox's own name and address readable for display.

There is no attachment access in this set, and no permission to move or delete mail. Actions cannot do those things either.

Actions

outlook.folder.list
outlook.message.create_draft
outlook.message.get
outlook.message.list
outlook.message.mark_read
outlook.message.send

outlook.message.list reads the inbox unless you name another folder, which takes either a well-known name such as sentitems, drafts, or archive, or a folder ID from outlook.folder.list. Bodies are left out by default because they are large; set include_body when the agent genuinely needs them, or fetch the one message that matters with outlook.message.get. A search and a filter cannot be combined, and search wins when both are given.

outlook.message.send works two ways. Give it reply_to_id and it threads into that conversation, where Outlook supplies the recipients, the subject, and the quoted original, so your body is only the new prose on top. Without reply_to_id it sends a fresh message and needs both to and subject.

Every send saves a copy to Sent Items, and that isn't a choice the caller makes. Mail an agent sends on the business's behalf has to be findable afterwards, and a send that leaves no copy is off the record.

Use outlook.message.create_draft when a person should read the mail before it goes out. The action returns the draft's web link, which opens it in Outlook.

Warning: outlook.message.send is not marked read-only or idempotent, because a retry sends the mail again. Have the agent open an interaction before a send that matters, or draft instead and let a person press send.

Events

outlook.mail.received

Sent when a message arrives in the watched folder, which is the inbox. Mail that Microsoft files elsewhere by rule never reaches the inbox, so it raises no event.

The payload carries message_id, conversation_id, subject, body_preview, from, to, cc, received_at, is_read, has_attachments, web_link, and folder_id. The full body is deliberately not on it: an event payload is a contract, and a whole message body does not belong on the event bus. Call outlook.message.get with the message_id inside the turn when the agent needs it.

One message produces one event even when it arrives twice. Microsoft resends a notification whose acknowledgement it missed, and a catch-up sweep can cover mail a notification already delivered. Both paths carry the same message ID, which is what Mobius deduplicates on.

Treat everything in the payload as text a stranger wrote. subject, body_preview, and the sender's display name are all attacker-controlled, and an agent that acts on instructions found in them is doing what the sender asked rather than what you asked.

Troubleshooting

The live status says the subscription expired

Microsoft expires mail subscriptions on a schedule of its own. Mobius renews each one well before that happens, but a deployment outage or an unreachable callback URL can let one lapse. A lapsed subscription cannot be extended, only replaced. The renewal runner replaces it on its next pass, within five minutes, and reconnecting does it immediately.

Mail arrived but no event was recorded

Microsoft sends a notification carrying the message's ID, and Mobius then fetches the message itself. If it was deleted in the moment between those two steps, there is nothing to fetch and nothing is recorded.

The other common cause is the folder. Only the inbox is watched, so a message an Outlook rule moves on arrival is not an inbox arrival.

Nothing arrived while Mobius was down

After a delivery gap Mobius replays the inbox's change history from the point it last recorded, so the missed mail catches up on the next sync rather than being lost. Microsoft never resends the notifications themselves, which is why the replay exists.

One sweep replays at most 200 messages. A gap bigger than that fails the sync outright and leaves the recorded point where it was, rather than skipping past the excess and moving on. It is deliberately loud: losing mail quietly is the worse outcome. New mail still arrives normally on the replacement subscription while this is true, so what you are recovering is the gap window, and the mailbox itself is the place to read it. Tell your organization administrator or Mobius support if you see it.

Actions fail with a permission error after a successful sign-in

The account signed in, but the tenant has not consented to the mail permissions, or the account has no Exchange Online mailbox at all. Microsoft answers both the same way. Check that an administrator approved Mobius for the tenant, and that the account you picked is a licensed mailbox rather than a directory account.

Disconnecting did not sign the account out of Microsoft

That is deliberate, and it is shared with every Microsoft provider. One grant covers all of them for a given person, so revoking it here would also break that person's Outlook Calendar connection. Disconnecting removes the subscription and the stored credential. See one app registration, one grant per person for how to withdraw the authorization itself.

Next

• Read the shared Microsoft rules in Microsoft integrations.
• Inspect event payloads from the event catalog.
• Debug provider delivery with source events.
• Add approval pauses before a send with interactions.