Set up Microsoft 365 for your environment

There are two ways to connect Microsoft 365 to your AI-School environment. First choose which route fits your organization.

Route	When	What you do
AI-School central app (default)	Personal connections with Outlook Mail, Outlook Calendar, Teams, and SharePoint/OneDrive.	An Entra admin grants organization consent via Connect Microsoft 365. After that, you enable the integrations as described in step 5 of this article. You do not need your own app, client secret, or Identity Provider.
Your own Entra app	You want to centrally import SharePoint folders into the knowledge base, employees already log in with Microsoft through their own app, or you want to manage the app yourself.	Follow this article starting at step 1.

If your organization already logs in with Microsoft through its own app (the Microsoft ID field of the environment is filled in), then all connections use that own app. The central route does not apply in that case.

Your own Entra app

With your own Microsoft Entra app, your organization can use the same app for Sign in with Microsoft and for Outlook, Teams, and SharePoint. You centrally determine which integrations and write actions are available. Users then only turn their personal connections on or off in Preferences → Tools → Connections.

The personal integrations work with supported models from OpenAI, Claude, Gemini, and Mistral. The selected model must be able to use tools. For personal connections, access follows the permissions of the signed-in Microsoft user. Organization consent does not automatically sign in all employees and does not give the AI independent access to all mailboxes. The central SharePoint knowledge base uses separate app permissions and the existing knowledge base permissions, as described later in this article.

What do you need?

A Microsoft 365 organization with Microsoft Entra ID and accounts with access to the desired services.
An administrator who may register an app and grant organization consent for the chosen Microsoft Graph permissions. An Azure subscription role alone is not sufficient; your Entra role must allow this consent.
Admin rights in the correct AI environment to make integrations available.
A platform administrator who can configure the Microsoft Identity Provider for this AI environment in Google Cloud Identity Platform.
An app registration in your own Microsoft directory, with a client secret and the two redirect URLs of the correct brand.

Signing in with Microsoft and accessing Microsoft data are two separate functions. A working Microsoft login alone does not mean that Outlook, Teams, or SharePoint is configured.

1. Register one organization app

Open the Microsoft Entra admin center and go to App registrations → New registration. Use a recognizable name, for example AI-School – your organization name. For your own organization, choose Accounts in this organizational directory only (Single tenant).

Save the following details from Overview:

Item	What for?
Directory (tenant) ID	Your organization’s Microsoft directory; this goes in the Microsoft ID field of the AI environment.
Application (client) ID	The registered app; this goes in the Microsoft Identity Provider.

These two IDs are different. Do not enter the client ID or the Firebase tenant ID in Microsoft ID.

2. Set the correct redirect URLs

Go to Authentication → Add a platform → Web. Add both of the URLs below for your brand, exactly as shown. The first handles sign-in; the second handles consent for the work account integrations.

Brand	Sign in with Microsoft	Work account integrations
AI-School	`https://ai-school-pro.firebaseapp.com/__/auth/handler`	`https://europe-west1-ai-school-pro.cloudfunctions.net/completeConnectorOAuth`
AI-Corporate	`https://ai-corporate.firebaseapp.com/__/auth/handler`	`https://europe-west1-ai-corporate.cloudfunctions.net/completeConnectorOAuth`
AI-Public	`https://ai-public-pro.firebaseapp.com/__/auth/handler`	`https://europe-west1-ai-public-pro.cloudfunctions.net/completeConnectorOAuth`

Use the URLs of the brand on which your environment runs. Your own organization name or tenant ID does not need to be entered in these URLs. The website URL, dashboard URL, and .web.app URL do not replace these callbacks. Register them as Web, even if you use the integration from a browser. You do not need to enable implicit token issuance or a public client flow for this.

3. Create a client secret and assign permissions

Go to Certificates & secrets → Client secrets → New client secret. Choose an appropriate lifetime and safely store the Value as soon as it is visible. Provide the value through the agreed secure channel for platform administration; the Secret ID is not the client secret. Track the expiration date and replace the secret before that date, including in the Identity Provider.

Then go to API permissions → Add a permission → Microsoft Graph → Delegated permissions. Add only the permissions for the integrations and actions your organization will offer.

Integration	Read permissions	Extra permissions for writing
Profile / basic	`User.Read`; the sign-in flow also requests `openid`, `profile`, `email`, and `offline_access`	None
Outlook Mail	`Mail.Read`	Drafts: `Mail.ReadWrite`. Send: `Mail.Send`.
Outlook Calendar	`Calendars.Read`	Write: `Calendars.ReadWrite`.
Microsoft Teams	`Chat.Read`, `ChannelMessage.Read.All`	Post: `Team.ReadBasic.All`, `Channel.ReadBasic.All`, `ChannelMessage.Send`.
SharePoint / OneDrive	`Sites.Read.All`, `Files.Read.All`	This work account integration does not offer write actions here.

Mail.ReadWrite does not grant sending rights; Mail.Send is required separately. Teams posting writes text messages in a selected channel, not private chat messages. For this integration, use Delegated permissions, not Application permissions. Even for permissions with All in the name, delegated access remains limited by the user’s access.

Click Grant admin consent for your organization and check that the selected permissions show as granted. This allows employees to use the approved access without having to grant organization rights themselves. Microsoft may still ask for sign-in, MFA, or renewed consent depending on your policy.

4. Connect the app in two places to the AI environment

Have the platform administrator select the correct environment and perform these settings:

In Admin → Environment → Tenant: enable the Microsoft sign-in method and enter the Directory (tenant) ID in Microsoft ID.
In Google Cloud → Identity Platform → the relevant tenant → Identity providers → Microsoft: enable the provider and enter the Application (client) ID and the client secret Value of the same Entra app.

The Identity Provider belongs to the Firebase/Identity Platform tenant of your AI environment, not to another organization or the general Admin environment. The work account integration reuses the app from this provider. The client secret does not belong in user preferences, chat messages, or ordinary environment fields.

Provide platform administration with the organization name, brand, Directory ID, client ID, secret value via the secure channel, expiration date, and desired integrations/permissions. An app ID alone is not enough.

5. Enable the integrations and write actions

Open the management environment of your organization → Tools → MCP. Turn on the Microsoft 365 integration under Suite shortcuts. The Microsoft rows become visible; when the entire suite is turned off, those rows remain hidden.

Choose per integration whether it is available. In the Write actions column, choose separately:

Outlook Mail → Drafts: create and modify drafts.
Outlook Mail → Send: actually send an existing draft.
Outlook Calendar → Write: create and modify appointments.
Microsoft Teams → Post: place text messages in a chosen Teams channel.

Click Save. A write action works only if both the integration and the corresponding management permission are enabled, Microsoft has granted the required permissions, and the user has turned on the connection personally. The user does not receive an additional form for write permissions.

Availability

The settings must also be supported by your brand’s backend. This write extension was targeted for release and tested on 7 October 2026 for OnderwijsSupport on AI-Corporate. That does not automatically mean the same extension is already available for AI-School, AI-Public, or any other environment. Ask platform administration to confirm when write actions are missing.

6. Check the setup

Have a user sign in to the correct AI environment and enable the desired integration according to Using Microsoft integrations. Check whether Microsoft displays the name of your own Entra app.

First test a recognizable draft and an appointment without attendees. Check the saved items in Outlook. Then test sending with an agreed test recipient and Teams posting in an agreed test channel. An appointment with attendees can send invitations or updates. An accepted send command is not yet a confirmed delivery.

When permissions are expanded, the connection tries to refresh tokens. If Microsoft requires sign-in or consent again, have the user reconnect the existing connection. No second app or separate user setting needs to be created.

Troubleshooting

Problem	Check
`AADSTS50011` / redirect mismatch	Both callbacks registered exactly as Web, for the correct brand.
A different app name appears during consent	The correct AI environment, Directory ID, and tenant-specific Microsoft Identity Provider; then reconnect.
Login works, but the integration does not	Also check the connector callback, Graph permissions, and organization consent.
Reading works, writing does not	Check management permission, corresponding delegated Graph permission, granted consent, and backend availability.
Client secret invalid or expired	The Value, not the Secret ID; also update the new secret in the Identity Provider.
Integration missing for the user	Check availability in Tools, user permissions for connections, and the selected AI environment.

More information

Central SharePoint knowledge base: set up Microsoft

A centrally connected folder works through the organization app, without each employee enabling a personal SharePoint connection. This requires two separate consents: an application permission with admin consent, and a read grant on exactly the folder (or site) the app may read. A working Microsoft login or admin consent alone does not yet give access.

There are two methods. Choose one method per connected folder; the AI environment never automatically falls back to the other.

	Folder grant (recommended)	Site grant
Application permission	`Files.SelectedOperations.Selected`	`Sites.Selected`
Grant on	The chosen folder in a document library	The entire site
What the app can read	This folder and subfolders that inherit the grant	All libraries and folders of the site
Existing SharePoint structure	Stays as it is; no separate site needed	Preferably a separate site for shared knowledge
Effect in SharePoint	Permission inheritance of the folder is broken (see below)	No effect on inheritance

1. Check the organization app

Use the same single-tenant app registration as for Microsoft sign-in in your AI environment. An existing app can be extended; a second integration app is not needed. In Microsoft Entra → App registrations → your app → Overview, check the Directory (tenant) ID and Application (client) ID. Use the client ID below, not the Object ID.

The Directory ID must be in Admin → Environment → Tenant → Microsoft ID. The client ID and the Value of a valid client secret must be in the Microsoft Identity Provider of exactly that AI environment. This configuration is maintained by platform administration. An expired secret also prevents the central import; keep track of the expiration date and replace the secret in time.

The central server connection uses client_credentials and does not request an extra redirect URL. The existing Web redirects for sign-in and personal work account integrations remain necessary; use the brand-specific URLs from the table earlier in this article.

Open API permissions → Add a permission → Microsoft Graph → Application permissions.
Search for Files.SelectedOperations.Selected (folder grant) or Sites.Selected (site grant), select the permission, and click Add permissions.
Have an authorized Entra administrator perform Grant admin consent for your organization.
Check that the permission, type Application, is shown as granted.

The knowledge base app only needs read access. Do not assign it the application permission Sites.Read.All, Files.Read.All, Sites.ReadWrite.All, Files.ReadWrite.All, or Sites.FullControl.All. Such broad permissions give access outside the chosen folder and mask a missing or revoked folder grant. If you choose the folder grant, also remove any previously added Sites.Selected and the associated site grant, so that the folder grant is the only boundary. The source list in AI-School warns when the app has such additional permissions.

The delegated permissions for personal Outlook, Teams, and SharePoint connections can remain on the same app. They do not replace the application permission for the central knowledge base.

3. Give the app read access to the folder or the site

This administrative action can be done with Microsoft Graph Explorer. Use an admin account in the same Microsoft directory, with SharePoint Administrator or a higher suitable admin role and access to the relevant site. An Azure subscription role or app ownership alone is not sufficient.

Sign in to Graph Explorer with the admin account and verify the organization shown.
Open your profile menu → Consent to permissions, find Sites.FullControl.All, and choose Consent. This is a delegated admin permission for Graph Explorer to manage grants; do not add it as an application permission on the knowledge base app. Use account-based consent when organization consent for all users is not needed.
Find the drive ID and the item ID of the folder. As soon as the folder URL has been entered, the connection form in AI-School shows the ready-made GET request. You can also compose it yourself: encode the folder URL as base64url (without trailing =) and prefix it with u!.

GET https://graph.microsoft.com/v1.0/shares/u!GECODEERDE-MAP-URL/driveItem?$select=id,name,webUrl,parentReference

In the response, id is the item ID of the folder and parentReference.driveId is the drive ID of the library (starts with b!). Check name and webUrl: this must be the folder you want to share. If the share request does not work, use the library and the path instead:

GET https://graph.microsoft.com/v1.0/sites/uworganisatie.sharepoint.com:/sites/uwsite:/drives?$select=id,name,webUrl
GET https://graph.microsoft.com/v1.0/drives/DRIVE-ID/root:/Pad/Naar/Map?$select=id,name,webUrl

First check existing grants on the folder. If your client ID is already listed with role read, you do not need to create a second grant.

GET https://graph.microsoft.com/v1.0/drives/DRIVE-ID/items/MAP-ID/permissions

If the grant is missing, choose POST on the same address and enter the following JSON in Request Body. CLIENT-ID-VAN-UW-APP is the Application (client) ID of your integration app, not the Graph Explorer app. Use only the role read.

{
  "roles": ["read"],
  "grantedToV2": {
    "application": {
      "id": "CLIENT-ID-VAN-UW-APP"
    }
  }
}

Choose Run query. A successful addition returns 201 Created. Check the read role and the client ID in the response and save the permission ID (id) for later checks or revocation.
Repeat this only for each other folder you deliberately want to connect. Each connected folder has its own grant.

Folder grant breaks inheritance

Microsoft breaks permission inheritance on the folder on which you set an application grant. The folder's existing user permissions are copied at that moment, but later changes to the permissions of the parent site or library no longer apply automatically to this folder. So after granting, check the folder's user permissions and from then on manage them on the folder itself. Keep in mind the Microsoft limit for unique permissions per library. Do not reset the folder to inherited permissions: that also removes the app's grant.

Subfolders and files with their own permissions. Subfolders and files that inherit permissions from the chosen folder are covered by the grant. If a subfolder or file has its own (broken) permissions without the app, the app cannot read it. AI-School skips such a subfolder entirely and reports the number in the source list; documents previously imported from it are withdrawn. A neighbouring folder or another library is never readable.

Site grant (alternative)

If you use Sites.Selected, find the site ID with GET https://graph.microsoft.com/v1.0/sites/uworganisatie.sharepoint.com:/sites/uwsite?$select=id,displayName,webUrl, check existing grants with GET .../sites/SITE-ID/permissions, and if needed add the grant with POST on the same address:

{
  "roles": ["read"],
  "grantedToIdentities": [
    {
      "application": {
        "id": "CLIENT-ID-VAN-UW-APP",
        "displayName": "NAAM-VAN-UW-INTEGRATIE-APP"
      }
    }
  ]
}

A site grant gives the app read access to the entire site. AI-School only imports the chosen folder, but that filter is not a Microsoft authorization boundary.

4. Connect the folder and check the result

Open Administration → Knowledge base → Add → SharePoint folders → Connect folder. Enter the real folder URL, taken from the address bar of the library or of OneDrive (not an invitation link), and under Microsoft access of the organization app choose the folder grant or the site grant. For a folder grant, enter the drive ID and item ID from step 3. AI-School then reads only that folder and checks that the folder URL matches the IDs; if they differ, the connection is refused. A folder in OneDrive for Business can also be connected, but it belongs to a single employee: if that employee leaves, the folder disappears and with it the knowledge source. For lasting knowledge, preferably use a SharePoint site. Choose scope, audience, and publication status according to the knowledge base guide.

Check with Refresh whether the documents were processed without errors. Use Synchronize now for another check and then ask a concrete chat question about an imported document. Verify that the answer mentions the correct central knowledge source.

Microsoft access and knowledge base permissions are two different things

The grant determines which folder the app may read. Which users receive the imported documents is determined by the knowledge base permissions in AI-School (school, audience, departments). Individual SharePoint permissions are not inherited. Therefore only connect restricted section or team content with an equally restricted knowledge base audience.

5. Revoke the grant

Remove the grant with DELETE on https://graph.microsoft.com/v1.0/drives/DRIVE-ID/items/MAP-ID/permissions/PERMISSION-ID (site grant: .../sites/SITE-ID/permissions/PERMISSION-ID). Revoking the admin consent blocks the app for all grants at once.

At the next check, AI-School no longer has access to the folder. All documents from that source are then no longer offered, not even in chat answers, and the source list shows that Microsoft denies access. This does not happen immediately: the automatic check runs every 15 minutes for at most 20 sources per round, so with more sources it takes longer. Use Synchronize now or Disconnect for an immediate effect. The same applies to a moved or deleted folder.

Problem	Microsoft-side check
Login works, but the central folder does not	The application permission must be of type Application and have admin consent; also check the separate grant on the folder or site.
"Microsoft denies access to the folder"	Correct Microsoft directory, drive ID, folder ID, client ID, and `read` grant; was the folder moved, deleted, or reset to inherited permissions?
Connection refused although the grant exists	The folder URL does not match the entered IDs. Copy the URL again from the library and check `webUrl` in the Graph response.
Warning about additional permissions	Remove broad application permissions and, for a folder grant, `Sites.Selected` together with the site grant.
Subfolders skipped	Those subfolders have their own permissions without the app. Let them inherit permissions or deliberately give them their own `read` grant.
`403` for the administrative action in Graph Explorer	Delegated `Sites.FullControl.All`, granted consent, admin role, and access to the site. Do not add a broad permission to the integration app as a solution.
"The organization app could not sign in to Microsoft"	Have platform administration update the new secret Value in the correct Microsoft Identity Provider; check admin consent.

For OnderwijsSupport on AI-Corporate, the central connection with a site grant was published and tested on 14 October 2026. The folder grant is available as soon as the relevant release has been published. Availability on AI-School, AI-Public, or another environment must be confirmed by platform administration.

Microsoft documentation: Selected permissions, add a grant on a folder, encode a share URL, and add a site grant.

Your own Entra app​

What do you need?​

1. Register one organization app​

2. Set the correct redirect URLs​

3. Create a client secret and assign permissions​

4. Connect the app in two places to the AI environment​

5. Enable the integrations and write actions​

6. Check the setup​

Troubleshooting​

More information​

Central SharePoint knowledge base: set up Microsoft​

1. Check the organization app​

2. Add the application permission and grant admin consent​

3. Give the app read access to the folder or the site​

Site grant (alternative)​

4. Connect the folder and check the result​

5. Revoke the grant​