> ## Documentation Index
> Fetch the complete documentation index at: https://lava.so/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft 365

> The Microsoft 365 connection and its Graph plumbing: user profile (/me), directory lookups, and any Graph v1.0 path not owned by a per-app connector.

The Microsoft 365 connection and its Graph plumbing: user profile (/me), directory lookups, and any Graph v1.0 path not owned by a per-app connector. For actual app work prefer the dedicated connectors — Microsoft Teams, Outlook Mail, Outlook Calendar, OneDrive, SharePoint — which share this ONE sign-in and carry per-app instructions.

See the [Microsoft 365 API docs](https://learn.microsoft.com/en-us/graph/overview) for full documentation.

<Warning>This provider requires your own credentials — connect your API key or OAuth account before use.</Warning>

## Connecting Your Microsoft 365 Account

Lava supports two ways to connect a Microsoft 365 account. Both end in the same place — Lava stores an encrypted OAuth token scoped to your wallet and uses it only to forward your own API calls.

**Via MCP (automatic):**

1. An agent connected to Lava's MCP calls a Microsoft 365 endpoint for the first time.
2. Lava detects no stored credential and returns a `browser_flow_required` response containing an authorization URL.
3. Open the URL in a browser — you land on Microsoft 365's consent screen.
4. Review the requested scopes (listed below) and click **Allow**.
5. Microsoft 365 redirects back to Lava. Your token is stored and the original agent call can now proceed.

**Via dashboard:**

1. Sign in at [lava.so/dashboard](https://lava.so/dashboard) and open **Connected Services** (`/dashboard/wallet/connected-services`).
2. Find **Microsoft 365** in the list of available providers and click **Connect**.
3. Authorize in Microsoft 365's consent screen.
4. You're redirected back to the Connected Services page, where Microsoft 365 now appears under **Stored Credentials**.

## Requested Permissions

Lava requests only the scopes needed to route your API calls. You see this list on Microsoft 365's consent screen before you authorize.

| Scope                     | What It Enables                                    |
| ------------------------- | -------------------------------------------------- |
| `offline_access`          | Refresh tokens                                     |
| `User.Read`               | Read user profile                                  |
| `Mail.ReadWrite`          | Read and manage email                              |
| `Mail.Send`               | Send email                                         |
| `Calendars.ReadWrite`     | Read and manage calendar                           |
| `Files.ReadWrite`         | Read and manage OneDrive files                     |
| `Team.ReadBasic.All`      | List joined Teams                                  |
| `ChannelMessage.Read.All` | Read Teams channel messages                        |
| `Sites.ReadWrite.All`     | Read and manage SharePoint sites, lists, and files |

## Using Microsoft 365

Once connected, your credential is available to any agent or SDK call routed through Lava's gateway — no token passing required. Call Microsoft 365 endpoints through `https://api.lava.so/v1/forward` and Lava injects your stored token automatically.

## Removing Microsoft 365

Disconnecting removes Lava's stored token immediately. Subsequent API calls return an auth error until you reconnect.

**Via dashboard:**

1. Open [Connected Services](https://lava.so/dashboard/wallet/connected-services).
2. Find **Microsoft 365** under **Stored Credentials**.
3. Click the trash icon and confirm.

**Via API or MCP:**

* REST: `DELETE https://api.lava.so/v1/credentials/microsoft_o365` (returns 204 No Content).
* MCP: call the `disconnect_service` tool with `service: "microsoft_o365"`.

**Also revoke from Microsoft 365:** visit [https://myapps.microsoft.com/](https://myapps.microsoft.com/), find the Lava app, and click **Remove**. This revokes the token on Microsoft 365's side in addition to deleting it from Lava.

## Data Handling

Lava stores your Microsoft 365 OAuth access and refresh tokens encrypted at rest, scoped to your wallet. Tokens are used only to forward your own API calls to [https://graph.microsoft.com/v1.0](https://graph.microsoft.com/v1.0). Refresh tokens rotate automatically; if a refresh fails, your next call prompts you to reconnect. Lava does not read, cache, or redistribute Microsoft 365 content beyond what's needed to proxy a single request.

## Support

Questions about this integration: [support@lava.so](mailto:support@lava.so).

## Next Steps

<CardGroup cols={2}>
  <Card title="All Providers" icon="grid" href="/docs/gateway/supported-providers">
    Browse all supported AI providers
  </Card>

  <Card title="Forward Proxy" icon="route" href="/docs/gateway/forward-proxy">
    Learn how to construct proxy URLs and authenticate requests
  </Card>
</CardGroup>