Skip to main content
The Microsoft 365 connection and its Graph plumbing: user profile (/me), directory lookups, and any Graph v1.0 path not owned by a per-app connector. For actual app work prefer the dedicated connectors — Microsoft Teams, Outlook Mail, Outlook Calendar, OneDrive, SharePoint — which share this ONE sign-in and carry per-app instructions. See the Microsoft 365 API docs for full documentation.
This provider requires your own credentials — connect your API key or OAuth account before use.

​
Connecting Your Microsoft 365 Account

Lava supports two ways to connect a Microsoft 365 account. Both end in the same place — Lava stores an encrypted OAuth token scoped to your wallet and uses it only to forward your own API calls. Via MCP (automatic):
  1. An agent connected to Lava’s MCP calls a Microsoft 365 endpoint for the first time.
  2. Lava detects no stored credential and returns a browser_flow_required response containing an authorization URL.
  3. Open the URL in a browser — you land on Microsoft 365’s consent screen.
  4. Review the requested scopes (listed below) and click Allow.
  5. Microsoft 365 redirects back to Lava. Your token is stored and the original agent call can now proceed.
Via dashboard:
  1. Sign in at lava.so/dashboard and open Connected Services (/dashboard/wallet/connected-services).
  2. Find Microsoft 365 in the list of available providers and click Connect.
  3. Authorize in Microsoft 365’s consent screen.
  4. You’re redirected back to the Connected Services page, where Microsoft 365 now appears under Stored Credentials.

​
Requested Permissions

Lava requests only the scopes needed to route your API calls. You see this list on Microsoft 365’s consent screen before you authorize.

​
Using Microsoft 365

Once connected, your credential is available to any agent or SDK call routed through Lava’s gateway — no token passing required. Call Microsoft 365 endpoints through https://api.lava.so/v1/forward and Lava injects your stored token automatically.

​
Removing Microsoft 365

Disconnecting removes Lava’s stored token immediately. Subsequent API calls return an auth error until you reconnect. Via dashboard:
  1. Open Connected Services.
  2. Find Microsoft 365 under Stored Credentials.
  3. Click the trash icon and confirm.
Via API or MCP:
  • REST: DELETE https://api.lava.so/v1/credentials/microsoft_o365 (returns 204 No Content).
  • MCP: call the disconnect_service tool with service: "microsoft_o365".
Also revoke from Microsoft 365: visit https://myapps.microsoft.com/, find the Lava app, and click Remove. This revokes the token on Microsoft 365’s side in addition to deleting it from Lava.

​
Data Handling

Lava stores your Microsoft 365 OAuth access and refresh tokens encrypted at rest, scoped to your wallet. Tokens are used only to forward your own API calls to https://graph.microsoft.com/v1.0. Refresh tokens rotate automatically; if a refresh fails, your next call prompts you to reconnect. Lava does not read, cache, or redistribute Microsoft 365 content beyond what’s needed to proxy a single request.

​
Support

Questions about this integration: support@lava.so.

​
Next Steps

All Providers

Browse all supported AI providers

Forward Proxy

Learn how to construct proxy URLs and authenticate requests