Outlook Mail
Connect Outlook Mail to search and read email, send, reply and forward with attachments, file messages into folders, and set rules and auto replies.
You register an app in the Microsoft Entra admin center, copy its Application (client) ID and a client secret Value into PopMCP, then sign in with Microsoft and approve access.
- Setup time
- 5 min
- Auth
- OAuth authorization
- API base URL
- https://graph.microsoft.com/v1.0
- Rate limits
- Outlook allows 10,000 requests per 10 minutes, 4 at a time and 150 MB of uploads per 5 minutes, per app per mailbox. All of Microsoft Graph allows 130,000 requests per 10 seconds per app across every tenant. A 429 says how long to wait in Retry-After.
Before you begin
- A Microsoft account with an Outlook mailbox: a work or school account on Microsoft 365 (Exchange Online), or a personal Outlook.com, Hotmail or Live account.
- A Microsoft Entra tenant you can register apps in: your organization's (members can register apps unless an admin turned that off, and the Application Developer role always can), or, with only a personal account, a tenant of your own such as the Default Directory of an Azure account.
- PopMCP's Redirect URI from the connect form: https://app.popmcp.com/api/providers/microsoft/callback
- For a shared mailbox: Full Access to it, and Send As to send from it, given to your account by an Exchange admin.
Get your credentials
Open App registrations
Go to entra.microsoft.com and sign in. If you belong to several tenants, use the Settings icon in the top bar to switch to the one that should own the app. Open Entra ID > App registrations and select New registration.
App registrations
| Display name | Application (client) ID | Created on | Certificates & secrets |
|---|---|---|---|
| Marketing siteSingle tenant only | 4c5d****-****-****-****-****8e21 | 3/14/2026 | Current |
Owned applications lists the apps you registered yourself.
Register the app
Enter a Name people will recognize, such as PopMCP: Microsoft shows it when asking for access. Under Supported account types pick Any Entra ID Tenant + Personal Microsoft accounts, so work, school and personal Outlook.com mailboxes can all sign in, then select Register. Single tenant only works too for your organization's mailboxes, but then the app's Directory (tenant) ID goes into PopMCP as well.
Register an application
The user-facing display name for this application.
Add PopMCP's Redirect URI
On the new app, open Authentication under Manage. On the Redirect URI configuration tab select Add Redirect URI, choose the Web tile, enter https://app.popmcp.com/api/providers/microsoft/callback exactly as PopMCP shows it, and select Configure.
PopMCP | Authentication
Choose Web, not Single-page application or Mobile and desktop: the address must match character for character.
Create a client secret
Open Certificates & secrets, stay on Client secrets and select New client secret. Enter a description such as PopMCP, choose when it expires (24 months at most; Microsoft recommends less than 12) and select Add. Copy the Value column straight away: Microsoft never shows it again. The Secret ID beside it is not the secret.
PopMCP | Certificates & secrets
| Description | Expires | Value | Secret ID |
|---|---|---|---|
| PopMCP | 4/24/2027 | Kq8~****************************3fZaCopy this one | 7d1e****-****-****-****-****0b9c |
Copy the Application (client) ID
Open Overview and copy the Application (client) ID. You only need the Directory (tenant) ID if you chose Single tenant only.
PopMCP
Overview
- Display name
- PopMCP
- Application (client) ID
- 2f6c****-****-****-****-****a91d
- Directory (tenant) ID
- 72f9****-****-****-****-****1db4
- Client credentials
- 0 certificate, 1 secret
- Redirect URIs
- 1 web, 0 spa, 0 public client
The Application (client) ID is a GUID. A value with a tilde in it is a client secret.
Paste both into PopMCP and sign in
In PopMCP put the ID in Application (client) ID and the secret's Value in Client secret Value (the Directory (tenant) ID under More options only for a Single tenant only app). To connect a shared mailbox instead of your own, enter its address under More options too. Select Sign in with Microsoft, pick the account whose mailbox you want, and select Accept.
Connect in PopMCP
Open your workspace, choose Outlook Mail in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| Application (client) IDtext | Only for your own app. In the Microsoft Entra admin center (entra.microsoft.com) open Entra ID, App registrations, New registration, pick Any Entra ID Tenant + Personal Microsoft accounts under Supported account types and select Register, then copy the Application (client) ID from Overview. |
| Client secret Valuesecret | In the app registration open Certificates & secrets, Client secrets, New client secret, then Add, and copy the Value column right away (it is shown once). Stored encrypted and used only on our server.Encrypted with AES-256-GCM on save and never shown again. |
| Directory (tenant) IDtext | Only for an app registered as Single tenant only. Copy it from the app's Overview page. |
| Shared mailboxtext | Connect a shared mailbox you can open instead of your own. Work or school accounts only; an Exchange admin must have given you Full Access to it. |
| Extra accesschecklist | — |
https://app.popmcp.com/api/providers/microsoft/callbackIn your app registration open Authentication, select Add Redirect URI, choose Web, enter this exact URL and select Configure. It must match exactly, or Microsoft refuses the sign-in. Every Microsoft connector uses this same URL.
PopMCP verifies the credential against Outlook Mail immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Permissions to request
PopMCP asks Outlook Mail for exactly the permissions you tick in the connect form. Unticked permissions leave their tools listed but failing, so keep the defaults unless you have a reason to narrow them.
Outlook Mail grants exactly what you tick. 0 of 1 are on by default.
Other
shared_mailboxesShared and delegated mailboxesLets tools read, file and send from other mailboxes you can open, by naming them. Work or school accounts only.
Verify it worked
PopMCP shows Outlook Mail as Connected under the mailbox's address, and outlook_mail_inbox_overview returns the Inbox's unread and total counts.
Troubleshooting
"The app's redirect URI does not match"
Why: Microsoft answered AADSTS50011: PopMCP's callback is not registered as a Web redirect URI on the app, or differs by a character.
Fix: Open **Authentication**, select **Add Redirect URI**, choose **Web**, enter `https://app.popmcp.com/api/providers/microsoft/callback` and select **Configure**, then connect again.
"Microsoft did not accept the app's client secret"
Why: The **Secret ID** was pasted instead of the secret's **Value** (AADSTS7000215), or the Value was cut short when copying.
Fix: Under **Certificates & secrets** create a new client secret, copy its **Value** right away and paste it into PopMCP.
"The app's client secret has expired"
Why: Client secrets last at most 24 months (AADSTS7000222).
Fix: Create a new client secret under **Certificates & secrets** and reconnect Outlook Mail with its Value.
"This app does not accept the kind of Microsoft account you signed in with"
Why: The app's **Supported account types** leaves out the account you signed in with, typically a personal Outlook.com account on an organization-only app.
Fix: Register the app with **Any Entra ID Tenant + Personal Microsoft accounts**, or sign in with an account from the app's own organization.
"Your app is registered for one organization only"
Why: A Single tenant only app was used without its tenant (AADSTS50194).
Fix: Copy the **Directory (tenant) ID** from the app's **Overview**, enter it under **More options** in PopMCP and connect again.
"Your organization needs an administrator to approve this app"
Why: Your organization lets only admins approve apps, or only apps from verified publishers (AADSTS65001 or AADSTS90094).
Fix: An admin opens the app in the Microsoft Entra admin center, **API permissions**, and selects **Grant admin consent** for the organization. Then connect again.
"This Microsoft account has no Exchange Online mailbox that Microsoft Graph can reach"
Why: The account has no Microsoft 365 mailbox license, its mailbox is on an on-premises Exchange server, or it is a personal account without Outlook.com mail.
Fix: Sign in with the account that has the mailbox, or ask your Microsoft 365 admin to assign an Exchange Online license.
"The signed-in account cannot open support@contoso.com"
Why: Your account has no Full Access to the shared mailbox, or the permission was added in the last hour and has not applied yet.
Fix: Ask an Exchange admin to give your account Full Access (and Send As to send from it), wait for it to apply, and connect again.
429 with ApplicationThrottled or MailboxConcurrency
Why: Outlook allows 10,000 requests per 10 minutes and 4 at a time per app per mailbox.
Fix: Wait the time Microsoft gives and try again. outlook_mail_search_messages, $select and the bulk tools (outlook_mail_move_messages, outlook_mail_update_messages) do in one call what would otherwise take many.