Skip to main content

​
Overview

The Microsoft Outlook integration lets agents work with the mailbox of the Aster member currently using them. It uses delegated Microsoft Graph access: every member signs in with their own Microsoft 365 work or school account, and an agent never inherits another member’s mailbox credentials. Outlook is configured independently from Microsoft SharePoint. Enabling, reconnecting, or disabling Outlook does not change the organization’s SharePoint authentication mode or credentials.

​
Setup Guide

1

Enable Outlook for the organization

An Aster admin opens Control Hub > Integrations, selects Microsoft Outlook, and clicks Enable Microsoft Outlook.
2

Authorize the admin's mailbox

Sign in with a Microsoft 365 work or school account and approve delegated read/write mail and send-mail access. This enables the organization and connects only that admin’s mailbox.
3

Add Outlook tools to an agent

Edit an agent and select the Outlook tools it needs. Prefer read-only tools unless the agent genuinely needs to draft, send, reply, or organize email.
4

Let each member connect

When a member opens an agent that uses Outlook tools, Aster prompts them to connect their own Microsoft account. Tokens remain server-side and are stored separately for each Aster user and organization.

​
Available Tools

  • outlook_search_messages — Search the mailbox using Outlook KQL or list recent messages.
  • outlook_read_message — Read one message and its attachment metadata.
  • outlook_read_thread — Read messages belonging to one Outlook conversation.
  • outlook_list_folders — Browse mail folders and retrieve IDs for scoped searches or moves.
  • outlook_download_attachment — Add a message attachment up to 25 MiB to the Aster conversation for analysis.
  • outlook_create_draft — Create a new unsent draft.
  • outlook_send_message — Send a new message from the connected member’s mailbox.
  • outlook_reply_message — Create a reply/reply-all draft, or send it when explicitly authorized.
  • outlook_modify_messages — Mark read/unread, archive, move to Deleted Items, move folders, flag, or manage categories.
For agents with sending or mailbox-management tools, add rules like:

​
Security

  • Per-user delegated access: tools call /me in Microsoft Graph using the acting member’s token.
  • No cross-user mailbox sharing: Outlook tokens are not stored in the organization connection blob.
  • Server-side tokens: access and refresh tokens are never returned to the browser or agent.
  • User-controlled disconnect: each member can remove their own Outlook credential from Control Hub > Integrations > Your connections without disabling Outlook for teammates.
  • Separate from SharePoint: Outlook changes do not modify either per-user or organization-shared SharePoint credentials.
  • Admin disable: disabling Outlook removes the organization enablement marker and all stored per-user Outlook tokens for that Aster organization.

​
Troubleshooting

The organization has enabled Outlook, but your Aster user has not authorized a Microsoft mailbox yet, or the refresh token expired. Use the connection prompt and sign in again.
Your Microsoft tenant may block end-user consent even though the delegated Graph permissions are not globally admin-only. Ask a Microsoft Entra administrator to approve the Aster application for the tenant.
Start with a simple term or omit query to list recent messages. Outlook search supports KQL properties such as from:, subject:, received:, and hasAttachments:true.
Microsoft Graph can return a new message ID after a move. Use the replacement ID returned by outlook_modify_messages for subsequent calls.
Microsoft Graph returns acceptance before Exchange finishes delivery. Delivery can still be delayed or rejected by Exchange transport rules, mailbox policies, throttling, or the recipient’s mail system.