> ## Documentation Index > Fetch the complete documentation index at: https://docs.consile.ai/llms.txt > Use this file to discover all available pages before exploring further. # Connect Outlook > Log in at Microsoft with the work account of the mailbox your AI should read, and approve Consile. The permissions are pure read permissions. The access is renewed automatically and can be revoked. *[Læs siden på dansk](https://docs.consile.ai/connect/forbind-outlook.md)* You connect Outlook by having the user whose mailbox and calendar your AI should read log in at Microsoft with their work or school account and approve Consile. Consile stores the resulting access encrypted per customer. Your AI never sees the access itself, only answers to your questions. Messages and events are fetched live from Microsoft and are not stored at Consile. See [Outlook](https://docs.consile.ai/en/connectors/outlook.md) for what the connector can do. > [!NOTE] > > You need an active Outlook subscription in the [portal](https://app.consile.ai), > or the system must be included in your plan > ([the free edition](https://docs.consile.ai/en/portal/free-edition.md) or > [the Consile Studio membership](https://docs.consile.ai/en/portal/membership.md)). You must log in with a > Microsoft work or school account that has a mailbox in Microsoft 365. Your AI > ([Claude](https://docs.consile.ai/en/connect/connect-claude.md) or [ChatGPT](https://docs.consile.ai/en/connect/connect-chatgpt.md)) > can be added before or after. > [!WARNING] > > The connection applies to your whole Consile account. All users with access to > Outlook in Consile read the mailbox that is connected, even if a colleague > connected it. If you have several agreements, they can all use every agreement. So > only give Outlook access to people who may read the connected mailboxes. See > [Who can read the mailbox?](https://docs.consile.ai/en/connectors/outlook.md#who-can-read-the-mailbox) Anyone on the team can connect an agreement that is not connected yet. Only an administrator can reconnect it or disconnect it, because that changes the connection for everyone. If an administrator reconnects with a different Microsoft account, the agreement then reads the new account's mailbox. ## Log in with the right account The Microsoft account you log in with is the mailbox your AI reads. If you are already logged in at Microsoft in the browser, Microsoft may use that account without asking. If the agreement should read another person's mailbox, have that person connect from their own computer, or choose the right account at Microsoft (for example with **Use another account**). ## How to connect **1. Open the connector in the portal** Go to Outlook in the [portal](https://app.consile.ai). Click **Connect now** at the top of the page, or **Connect** next to the agreement on the **Connections** card. The portal calls each connection to the system an agreement. Right after the purchase, the **Connect Outlook** button on the **Subscription activated** page takes you to that page. If you have not accepted Consile's terms yet, you are asked to do so first. **2. Authorise access** In the **Connect Microsoft** step, the portal shows the four permissions Consile asks Microsoft for: `Mail.Read`, `Calendars.Read`, `User.Read` and `offline_access`. Click **Authorise access**. You are sent to Microsoft's login. **3. Log in with your work account** Log in with the Microsoft work or school account whose mailbox your AI should read. Microsoft refuses a login with a personal Microsoft account. **4. Confirm with Microsoft** Microsoft shows that Consile is asking to read your mail and your calendars, read your profile and keep that access. Confirm to continue. You are then sent back to the portal. > [!TIP] > > The portal shows **Outlook is connected**, and the agreement shows as > **Connected**. On the connector's page, the agreement is named after the > connected user, for example ` (@example.com)`. Your AI can now > read the mailbox and the calendar. If you have not already added the address > `https://mcp.consile.ai/outlook/mcp` in your AI, do it now. > [!TIP] > > The connection is shared by the whole company, so colleagues do not have to > connect the same mailbox again. An administrator gives them access under > **Team**, and each colleague adds the address in their own AI and logs in with > their own Consile login. See [Team](https://docs.consile.ai/en/portal/team.md). ## If Microsoft asks for administrator approval Many organizations do not let users approve on their own that an app reads mail and calendars. Then Microsoft shows that an administrator must approve before you can continue. In that case, contact your Microsoft administrator. There are two ways: * **The administrator approves for the whole organization.** When a Microsoft administrator logs in in the step above, they can tick consent on behalf of the organization and approve. After that, users can connect without being stopped. Note that the account that completes the connection is the mailbox the agreement reads. If the administrator connected their own mailbox and it should not have been theirs, have a Consile administrator disconnect and connect again with the right user. * **The user sends a request.** If your organization has turned on requests for administrator approval, you can send a request from Microsoft's page. Once the administrator has approved it, start over in the portal. If you cannot get any further, write to [support@consile.dk](mailto:support@consile.dk). ## What exactly am I approving? > [card] Read-only, also at Microsoft > > `Mail.Read` and `Calendars.Read` are Microsoft's pure read permissions. An > access with them cannot send, move or delete messages or change the calendar, > not even outside Consile. Consile has no write tools for Outlook and only sends > read requests. > [card] Only the user's own mailbox > > The permissions apply to the user who logs in: the user's own mail and own > calendars. Shared mailboxes and colleagues' mailboxes are not included. > `User.Read` gives the user's name and email address for the agreement's name. > `offline_access` keeps the connection alive. > [card] No content is stored > > Messages, attachments and events are fetched live from Microsoft when your AI > asks, and passed straight on. Consile stores no copy and does not log the > content. > [card] Encrypted per customer > > Consile stores the access encrypted with a key that applies only to your > account, and never logs it. Your AI is never given it. It is renewed > automatically in the background. ## The access is renewed, but the connection can stop Consile renews the access automatically, so you do not have to reconnect during normal use. > [!WARNING] > > If the renewal fails, or Microsoft refuses the access (for example because > Consile has been removed in your Microsoft organization), your AI is told that > the connection must be set up again from the Consile portal. The portal can > still show **Connected**, because the stored access is still there. How an administrator reconnects: * If the agreement says **Access revoked**, click **Reconnect**, and follow the steps above. * Otherwise: click the menu (the three dots) next to the agreement on the **Connections** card, choose **Disconnect**, and confirm with **Disconnect**. Then click **Connect**, and follow the steps above. * You can also ask your AI for a new connection link. Ask in the connector that belongs to the agreement (for example `outlook-2`), so the link connects exactly that agreement. Log in with the same Microsoft account as before. If the agreement is afterwards connected to a different account, the page after the connection says *Note: This portal is now connected to a different account than before. Check the portal list if that wasn't intended.* The word portal here means agreement. > [!NOTE] > > If your AI is instead told that Outlook answered 403, the connected user lacks > access to what was asked for, or your administrator has not approved the > permission the tool needs. Reconnecting does not help. Ask a Microsoft 365 > administrator for help. ## If the connection fails If the approval does not succeed, the portal shows **Connection was not completed** and a technical reason. The most common ones: * `token_exchange_failed`: Microsoft did not send back a valid approval, typically because you cancelled at Microsoft. Try again, and approve the access. * `unexpected_scope`: Microsoft's approval did not match what Consile asks for. Try again. * `no_refresh_token`: Microsoft did not return renewable access. Try again. * `state_expired`, `invalid_state` or `state_unknown_or_consumed`: more than 10 minutes passed, or the same approval was used twice (for example with the browser's back button). Start over in the portal. Click **Try again** to get back to the connector's page, and start over with **Connect now** or **Connect**. If that does not help, write to [support@consile.dk](mailto:support@consile.dk) and include the technical reason. ## Several mailboxes One agreement is one mailbox. If your AI should read several mailboxes, you add one agreement per mailbox. **1. Add an agreement** Open Outlook in the portal. On the **Connections** card, an administrator clicks **Add agreement (149.50 kr/mo.)**. The agreement is added to the existing subscription and charged pro rata for the rest of the period. **2. Connect the agreement** When the new agreement is ready (typically after a few seconds), click **Connect** next to it, and the user whose mailbox the agreement should read completes the steps above. **3. Add the address in your AI** Each agreement has its own address, for example `https://mcp.consile.ai/outlook-2/mcp`. Copy it from the card, and add it as an extra connector in your AI. Remember that everyone with access to Outlook in Consile can use all the agreements. See [Who can read the mailbox?](https://docs.consile.ai/en/connectors/outlook.md#who-can-read-the-mailbox) If you connect a mailbox that is already connected on another agreement, Consile moves the connection to the agreement that already has the mailbox, and the new agreement is still free. The page after the connection says *Note: This account was already connected as another portal, so that connection was refreshed instead. The new slot is still free.* Connect the free agreement with another mailbox, or remove it. Under [the Consile Studio membership](https://docs.consile.ai/en/portal/membership.md#one-more-agreement-in-a-system) and in [the free edition](https://docs.consile.ai/en/portal/free-edition.md), other rules apply to adding an agreement. The **Connections** card shows what applies to you. An administrator removes an agreement with the menu next to it: choose **Remove the agreement**, and confirm with **Remove agreement**. If you remove an agreement that is not the last one, the last agreement moves up into the free slot and takes its address (for example `https://mcp.consile.ai/outlook-2/mcp` instead of `https://mcp.consile.ai/outlook-3/mcp`). You must update the address in your AI. You remove the last agreement by cancelling the subscription under **Subscription**. ## Revoke access You can remove the access again at any time: * **In the portal:** an administrator clicks the menu (the three dots) next to the agreement on the **Connections** card, chooses **Disconnect** and confirms with **Disconnect**. The stored access and the agreement's name are deleted at Consile right away. The subscription continues until an administrator cancels it under **Subscription**. If you have several agreements, an administrator can also remove an agreement entirely with **Remove the agreement**. Its access is then deleted too. * **At Microsoft:** the approval stays in your Microsoft organization until you remove it yourselves. If you also want to remove it, an administrator does so under **Enterprise apps** in the Microsoft Entra admin center. Shortly after, the connector stops working, but the portal can still show it as **Connected** until you disconnect it in the portal. * **When the subscription ends:** if you cancel Outlook under **Subscription**, Consile automatically deletes the stored access when the subscription ends. If a payment is only late, the tools do not work in the meantime, but the stored access is kept, so the connection works again without a new approval once the payment is in place. More about data processing in [Security & data](https://docs.consile.ai/en/essentials/security-and-data.md). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.