# Outlook Mail setup for PopMCP

You register an app in the Microsoft Entra admin center, copy its Application (client) ID and a client secret Value into PopMCP, then sign in with Microsoft and approve access.

- Auth: OAuth authorization
- Setup time: 5 min
- API base URL: https://graph.microsoft.com/v1.0
- Credentials screen: https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade
- Provider docs: https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app

## Before you begin

- A Microsoft account with an Outlook mailbox: a work or school account on Microsoft 365 (Exchange Online), or a personal Outlook.com, Hotmail or Live account.
- A Microsoft Entra tenant you can register apps in: your organization's (members can register apps unless an admin turned that off, and the Application Developer role always can), or, with only a personal account, a tenant of your own such as the Default Directory of an Azure account.
- PopMCP's Redirect URI from the connect form: https://app.popmcp.com/api/providers/microsoft/callback
- For a shared mailbox: Full Access to it, and Send As to send from it, given to your account by an Exchange admin.

## Get your credentials

### 1. Open App registrations

Go to entra.microsoft.com and sign in. If you belong to several tenants, use the Settings icon in the top bar to switch to the one that should own the app. Open Entra ID > App registrations and select New registration.

Screen: https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade

### 2. Register the app

Enter a Name people will recognize, such as `PopMCP`: Microsoft shows it when asking for access. Under Supported account types pick Any Entra ID Tenant + Personal Microsoft accounts, so work, school and personal Outlook.com mailboxes can all sign in, then select Register. Single tenant only works too for your organization's mailboxes, but then the app's Directory (tenant) ID goes into PopMCP as well.

Screen: https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade

### 3. Add PopMCP's Redirect URI

On the new app, open Authentication under Manage. On the Redirect URI configuration tab select Add Redirect URI, choose the Web tile, enter `https://app.popmcp.com/api/providers/microsoft/callback` exactly as PopMCP shows it, and select Configure.

### 4. Create a client secret

Open Certificates & secrets, stay on Client secrets and select New client secret. Enter a description such as `PopMCP`, choose when it expires (24 months at most; Microsoft recommends less than 12) and select Add. Copy the Value column straight away: Microsoft never shows it again. The Secret ID beside it is not the secret.

### 5. Copy the Application (client) ID

Open Overview and copy the Application (client) ID. You only need the Directory (tenant) ID if you chose Single tenant only.

### 6. Paste both into PopMCP and sign in

In PopMCP put the ID in Application (client) ID and the secret's Value in Client secret Value (the Directory (tenant) ID under More options only for a Single tenant only app). To connect a shared mailbox instead of your own, enter its address under More options too. Select Sign in with Microsoft, pick the account whose mailbox you want, and select Accept.

## Fields PopMCP asks for

- Application (client) ID (clientId) [required]: Only for your own app. In the Microsoft Entra admin center (entra.microsoft.com) open Entra ID, App registrations, New registration, pick Any Entra ID Tenant + Personal Microsoft accounts under Supported account types and select Register, then copy the Application (client) ID from Overview.
- Client secret Value (clientSecret) [required]: In the app registration open Certificates & secrets, Client secrets, New client secret, then Add, and copy the Value column right away (it is shown once). Stored encrypted and used only on our server.
- Directory (tenant) ID (tenant): Only for an app registered as Single tenant only. Copy it from the app's Overview page.
- Shared mailbox (sharedMailbox): Connect a shared mailbox you can open instead of your own. Work or school accounts only; an Exchange admin must have given you Full Access to it.
- Extra access (extraAccess): 

## Callback URL to register

https://app.popmcp.com/api/providers/microsoft/callback

## Scopes requested

- User.Read
- People.Read
- Mail.ReadWrite
- Mail.Send
- MailboxSettings.ReadWrite
- Contacts.ReadWrite
- offline_access
- openid
- profile
- email

## Verify

PopMCP shows Outlook Mail as Connected under the mailbox's address, and outlook_mail_inbox_overview returns the Inbox's unread and total counts.

## Troubleshooting

### "The app's redirect URI does not match"

Cause: Microsoft answered AADSTS50011: PopMCP's callback is not registered as a Web redirect URI on the app, or differs by a character.

Fix: Open **Authentication**, select **Add Redirect URI**, choose **Web**, enter `https://app.popmcp.com/api/providers/microsoft/callback` and select **Configure**, then connect again.

### "Microsoft did not accept the app's client secret"

Cause: The **Secret ID** was pasted instead of the secret's **Value** (AADSTS7000215), or the Value was cut short when copying.

Fix: Under **Certificates & secrets** create a new client secret, copy its **Value** right away and paste it into PopMCP.

### "The app's client secret has expired"

Cause: Client secrets last at most 24 months (AADSTS7000222).

Fix: Create a new client secret under **Certificates & secrets** and reconnect Outlook Mail with its Value.

### "This app does not accept the kind of Microsoft account you signed in with"

Cause: The app's **Supported account types** leaves out the account you signed in with, typically a personal Outlook.com account on an organization-only app.

Fix: Register the app with **Any Entra ID Tenant + Personal Microsoft accounts**, or sign in with an account from the app's own organization.

### "Your app is registered for one organization only"

Cause: A Single tenant only app was used without its tenant (AADSTS50194).

Fix: Copy the **Directory (tenant) ID** from the app's **Overview**, enter it under **More options** in PopMCP and connect again.

### "Your organization needs an administrator to approve this app"

Cause: Your organization lets only admins approve apps, or only apps from verified publishers (AADSTS65001 or AADSTS90094).

Fix: An admin opens the app in the Microsoft Entra admin center, **API permissions**, and selects **Grant admin consent** for the organization. Then connect again.

### "This Microsoft account has no Exchange Online mailbox that Microsoft Graph can reach"

Cause: The account has no Microsoft 365 mailbox license, its mailbox is on an on-premises Exchange server, or it is a personal account without Outlook.com mail.

Fix: Sign in with the account that has the mailbox, or ask your Microsoft 365 admin to assign an Exchange Online license.

### "The signed-in account cannot open support@contoso.com"

Cause: Your account has no Full Access to the shared mailbox, or the permission was added in the last hour and has not applied yet.

Fix: Ask an Exchange admin to give your account Full Access (and Send As to send from it), wait for it to apply, and connect again.

### 429 with ApplicationThrottled or MailboxConcurrency

Cause: Outlook allows 10,000 requests per 10 minutes and 4 at a time per app per mailbox.

Fix: Wait the time Microsoft gives and try again. outlook_mail_search_messages, $select and the bulk tools (outlook_mail_move_messages, outlook_mail_update_messages) do in one call what would otherwise take many.

---

Source: https://www.docs.popmcp.com/docs/integrations/outlook-mail/