# Outlook Mail

> Source: https://truto.one/docs/integration-guides/outlook/

Outlook Mail connects through Microsoft Graph in one of two ways: a user signs in with their Microsoft work or school account (OAuth 2.0), or Truto uses an app registration in your customer's Microsoft Entra tenant with no user involved (OAuth 2.0 Client Credentials).

## Install the Outlook Mail integration

Install Outlook Mail from [Available integrations](https://app.truto.one/integrations/available/eed118d1-b2dc-4015-8e26-71efbb54a05b) in each environment you connect accounts from.

## Use your own Outlook Mail OAuth app (optional)

Truto ships an Outlook Mail OAuth app, so OAuth 2.0 works without any setup. To show your own app on the consent screen instead, register an app in Microsoft Entra ID that allows accounts in any organizational directory, register the redirect URL below, and set the app's Client ID and Client Secret on the installed integration. See [Overriding OAuth credentials](/docs/guides/integrations/overriding-oauth-credentials).

```text
https://api.truto.one/connect/outlook/callback
```

By default, Truto asks Outlook Mail for these scopes. The connect screen lists them under **Permissions required**, and you can change them when you override the OAuth credentials.

- `email`
- `offline_access`
- `openid`
- `profile`
- `https://graph.microsoft.com/Mail.Read.Shared`
- `https://graph.microsoft.com/Mail.ReadWrite`
- `https://graph.microsoft.com/Mail.Send`
- `https://graph.microsoft.com/User.Read`
- `https://graph.microsoft.com/User.ReadBasic.All`
- `https://graph.microsoft.com/Contacts.Read`

## Set up an app for client credentials

Only needed for the **OAuth 2.0 Client Credentials** method. Do this in the Microsoft Entra tenant whose mailboxes you are connecting.

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) and go to **Entra ID** → **App registrations** → **New registration**. Enter a name and click **Register**.
2. On the app's **Overview** page, copy the **Application (client) ID** and the **Directory (tenant) ID**.
3. Open **Certificates & secrets**, create a client secret and copy its value. Microsoft shows the value only once.
4. Open **API permissions** → **Add a permission** → **Microsoft Graph** → **Application permissions**, and add `Mail.Read`, `Mail.Send` and `User.Read.All`.
5. Click **Grant admin consent** for your tenant. Application permissions always need an administrator's consent.

See Microsoft's [Register an application](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app) and [Get access without a user](https://learn.microsoft.com/en-us/graph/auth-v2-service) guides.

## Connect an Outlook Mail account

1. Click **Connect Account**.
   ![Click Connect Account](https://docs-assets.truto.one/truto-connect-account.png)
2. Enter a Tenant ID. This can be any ID you choose. Click **Get connection link**.
   ![Get connection link](https://docs-assets.truto.one/truto-connect-account-modal.png)
3. Open the generated link. You can also share it with your customer so they connect their own Outlook Mail account.
   ![Share connection link](https://docs-assets.truto.one/truto-connect-account-link.png)
4. Select **Outlook Mail**.
5. Pick an authentication method: **OAuth 2.0**, **OAuth 2.0 Client Credentials**. Each one is described below.

### OAuth 2.0

Click **Connect**.

Sign in with a Microsoft account and allow access. Only work or school accounts can sign in.

### OAuth 2.0 Client Credentials

Fill in the form and click **Connect**:

| Field | Required | What to enter |
|---|---|---|
| **Client ID** | Yes | The app's **Application (client) ID**. |
| **Client Secret** | Yes | The client secret **Value**. |
| **Tenant ID** | Yes | The **Directory (tenant) ID**. |

The connect screen reminds you that this method needs the `Mail.Read`, `Mail.Send` and `User.Read.All` **application** permissions, not delegated ones, with admin consent. See [Set up an app for client credentials](#set-up-an-app-for-client-credentials).

The new account appears under **Integrated Accounts**. Click its Account ID to see its details and make API calls.