How to Connect Outlook Microsoft Graph to OpenClaw

Go to portal.azure.com and sign in with your Microsoft account. Navigate to 'Azure Active Directory' (search for it in the top bar). In the left sidebar, click 'App registrations', then 'New registration'. Fill in the registration form: - Name: 'OpenClaw Graph Integration' (or any descriptive name) - Supported account types: 'Accounts in this organizational directory only' for work accounts, or 'Accounts in any organizational directory and personal Microsoft accounts' if you use a personal @outlook.com or @hotmail.com account - Redirect URI: leave blank for now (not needed for client credentials flow) Click 'Register'. Azure creates the application and takes you to its overview page. Copy two values immediately: 1. **Application (client) ID** — this is your MICROSOFT_CLIENT_ID 2. **Directory (tenant) ID** — you will need this for the token endpoint URL Next, create a client secret. Go to 'Certificates & secrets' in the left sidebar, click 'New client secret'. Set a description ('OpenClaw') and an expiry (24 months is standard — add a calendar reminder to rotate before it expires). Click 'Add'. Copy the secret Value immediately — this is your MICROSOFT_CLIENT_SECRET and is only shown once.

1# Values to copy from Azure Portal after registration:
2# Application (client) ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx (MICROSOFT_CLIENT_ID)
3# Directory (tenant) ID:   yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy (needed for token URL)
4# Client Secret Value:     zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz (MICROSOFT_CLIENT_SECRET)
5
6# Test token acquisition (client credentials flow):
7curl -X POST \
8  "https://login.microsoftonline.com/YOUR_TENANT_ID/oauth2/v2.0/token" \
9  -d "client_id=YOUR_CLIENT_ID" \
10  -d "client_secret=YOUR_CLIENT_SECRET" \
11  -d "scope=https://graph.microsoft.com/.default" \
12  -d "grant_type=client_credentials"
13# Returns access_token if credentials are valid

The Azure app registration needs explicit API permissions to access Outlook data. Without these permissions, even a valid token will get 403 errors when calling Graph endpoints. In your Azure app registration, go to 'API permissions' in the left sidebar. Click 'Add a permission' > 'Microsoft Graph' > 'Application permissions' (not Delegated — application permissions work without a user being signed in, which is required for automation workflows). Add these permissions based on what you need: - `Mail.Read` — read Outlook emails - `Mail.ReadWrite` — read and send emails (include if you need to send) - `Calendars.Read` — read calendar events - `Calendars.ReadWrite` — create and update calendar events - `Contacts.Read` — read contacts - `User.Read.All` — read user profile information After adding permissions, click 'Grant admin consent for [your organization]'. This is the critical step that activates the permissions — without admin consent, the permissions are listed but not effective. For personal Microsoft accounts, you grant consent yourself. For organizational accounts, an IT admin may need to approve this step.

1# After granting consent, verify permissions are effective by calling the Graph API:
2curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
3     "https://graph.microsoft.com/v1.0/users"
4
5# For personal accounts, test against your own mailbox:
6curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
7     "https://graph.microsoft.com/v1.0/me/messages?$top=5"
8
9# If you see 403, permissions were not granted or admin consent is pending
10# If you see 200, the permissions are active and the integration can proceed

Open `~/.openclaw/config.yaml` and add the Microsoft Graph integration block. The config stores both your client credentials and the tenant ID needed to construct the correct OAuth token endpoint URL. The `tenant_id` determines which Azure AD directory is used for authentication. For personal Microsoft accounts (Outlook.com, Hotmail.com), use `consumers` as the tenant ID. For organizational accounts, use your specific tenant ID (the UUID from Step 1). The `mailbox` field specifies which mailbox to operate against. Use `me` to target the service account associated with the client credentials, or specify a full user email address for organizational accounts where the app has been granted access to specific mailboxes. After saving and reloading OpenClaw, the integration will request an access token using the client credentials flow and confirm the token can reach the Graph API. Check the OpenClaw log for the connection status.

1# ~/.openclaw/config.yaml
2integrations:
3  outlook-graph:
4    client_id: "YOUR_AZURE_APP_CLIENT_ID"
5    client_secret: "YOUR_AZURE_APP_CLIENT_SECRET"
6    tenant_id: "YOUR_AZURE_TENANT_ID"      # or 'consumers' for personal accounts
7    mailbox: "your-email@outlook.com"      # Target mailbox email address
8    graph_endpoint: "https://graph.microsoft.com/v1.0"
9    token_endpoint: "https://login.microsoftonline.com/{{tenant_id}}/oauth2/v2.0/token"
10    scopes:
11      - "https://graph.microsoft.com/.default"
12    # Optional: configure what data types to enable
13    enable_mail: true
14    enable_calendar: true
15    enable_contacts: true

With authentication configured, test the core operations you will use in workflows. The Graph API uses OData query syntax for filtering, sorting, and selecting specific fields — this is more powerful than what IMAP provides but has a steeper learning curve. Start with a simple mail query to confirm email access works, then test calendar event retrieval. The Graph API returns rich structured data for both — mail messages include all headers and metadata, calendar events include attendees, recurrence rules, online meeting links, and Microsoft Teams join URLs. The key Graph endpoints for Outlook are `/me/messages` for mail, `/me/events` for calendar, and `/me/contacts` for the address book. For organizational accounts with Application permissions targeting other users' mailboxes, replace `/me/` with `/users/USER_EMAIL/`.

1# Query recent Outlook emails (last 10, unread first)
2curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
3     "https://graph.microsoft.com/v1.0/me/messages?\$top=10&\$filter=isRead eq false&\$orderby=receivedDateTime desc&\$select=subject,from,receivedDateTime,bodyPreview"
4
5# Query calendar events for the next 7 days
6curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
7     "https://graph.microsoft.com/v1.0/me/events?\$filter=start/dateTime ge '2026-03-30T00:00:00'&\$orderby=start/dateTime&\$select=subject,start,end,attendees,onlineMeeting"
8
9# Send an email via Graph
10curl -X POST \
11     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
12     -H "Content-Type: application/json" \
13     -d '{
14       "message": {
15         "subject": "Test from OpenClaw",
16         "body": { "contentType": "Text", "content": "Testing Graph API send" },
17         "toRecipients": [{ "emailAddress": { "address": "recipient@example.com" } }]
18       }
19     }' \
20     "https://graph.microsoft.com/v1.0/me/sendMail"

Configure OpenClaw workflows that use the Microsoft Graph integration to monitor and act on Outlook activity. The most common patterns are: inbox monitoring for specific message criteria, calendar event processing for meeting briefings, and cross-service workflows that combine email data with calendar actions. The workflow trigger for mail monitoring uses the `outlook-graph` integration key with the `new-message` event type. Calendar workflows can use the `schedule` trigger to query events at a set time each day. For RapidDev's recommended approach to complex Microsoft 365 automation, start with a single workflow that logs incoming mail matching a specific sender or subject filter. Once that is working reliably, add downstream actions (calendar creation, notifications, CRM logging) one at a time. Because Graph API tokens expire every 60 minutes, OpenClaw's Graph integration handles token refresh automatically using your client credentials — you do not need to manage this manually.

1# ~/.openclaw/config.yaml — Outlook Graph automation workflows
2workflows:
3  outlook-vip-alert:
4    trigger:
5      integration: outlook-graph
6      event: new-message
7      conditions:
8        - field: from.emailAddress.address
9          in: ["boss@company.com", "client@important.com"]
10    actions:
11      - type: log
12        message: "VIP email: {{message.subject}} from {{message.from.emailAddress.address}}"
13
14  morning-calendar-briefing:
15    trigger:
16      type: schedule
17      cron: "0 8 * * MON-FRI"   # Weekdays at 8 AM
18    actions:
19      - type: integration-query
20        integration: outlook-graph
21        query: calendar-events
22        params:
23          start: "{{date.today}}T00:00:00"
24          end: "{{date.today}}T23:59:59"
25      - type: log
26        message: "Today's meetings: {{result.count}} events"