Every claim is tagged: tested, sourced, reported, inferred or unknown. See how

← All guides
Researched guide

Microsoft (Outlook / Graph)

Register an app in Microsoft Entra (Azure). For multi-tenant apps that ask for more than basic sign-in, unverified publishers can face consent warnings or blocks; publisher verification is free but needs a verified Partner account.

Tier 3 · Review required30-60 min hands-onResearched 2026-10-20
DifficultyTier 3 · Review required

Sourced Registration is instant, but Microsoft says users may be unable to consent to newly registered multitenant apps that are not publisher verified when risk-based step-up consent is enabled; verification needs a verified partner account and domain. [e1]

Your time (hands-on)30-60 min

Inferred Our estimate for registration plus secret and permissions. Publisher verification time is unknown.

Approval waitMinutes, once set up

Sourced Microsoft says developers who already meet the publisher-verification requirements can be verified in minutes. How long it takes to get the Partner account itself verified is not stated. [e1][e8]

Composio managed authAvailable

Sourced Composio's Outlook toolkit page lists OAuth2 and S2S_OAUTH2 and says 'Composio-managed OAuth available.' So a developer can connect users without registering their own provider app first; register your own only for your own branding, scopes or rate limits. This is the Outlook toolkit page.

Open Composio's toolkit page

Who does what

An agent can

  • Check your publisher-verification prerequisites against the list.
  • Build the Composio config from credentials.

You must

  • Register the app, handle secrets, and own the partner/domain verification.

Steps

  1. Register the app in EntraYouSourced

    App registrations > New registration; choose supported account types (Composio uses 'any organizational directory and personal Microsoft accounts'); platform Web; redirect URI from your Composio auth config. [e2]

    Why you: Needs your signed-in Azure/Entra session.

  2. Create a client secretYouSourced

    Certificates & secrets > New client secret; copy the Value immediately. [e2]

    Why you: Secret goes to your secret store.

  3. Add delegated Graph permissionsYouSourced

    For Outlook mail: Mail.Read, Mail.Send, offline_access, openid, profile, email. [e2]

    Why you: Needs your Entra session.

  4. Create the Composio auth config and connectYou or agentSourced

    Own developer credentials; enter client ID, secret, redirect URI; connect an account and test a tool. [e2]

  5. If other organizations will use it: pursue publisher verificationYouSourced

    Set a publisher domain, verify your Partner account, associate the PartnerID with the app. [e1]

    Why you: Needs partner account, MFA and domain ownership.

Requirements

  • Sourced Publisher verification needs a verified Microsoft AI Cloud Partner Program (formerly MPN) account that is the partner global account, an app registered in a Microsoft Entra work/school tenant, a publisher domain that is not *.onmicrosoft.com, and MFA for the initiating user. [e1]
  • Sourced No charges are associated with completing the prerequisites for publisher verification. [e1]
  • Sourced Publisher verification needs a Partner One ID on a verified Microsoft AI Cloud Partner Program account. [e9]

Scopes and access

  • Sourced Composio's example uses delegated Microsoft Graph permissions Mail.Read, Mail.Send, offline_access and openid/profile/email. [e2]

Review process

  • Sourced Publisher verification verifies the organization is authentic; the badge does not indicate app quality. [e1]
  • Sourced Multitenant apps that are not publisher verified show a warning on the consent screen for users in other tenants. [e10]

Gotchas

  • Sourced The client secret you need is the secret Value, not the secret ID, and it is shown only once. [e2]
  • Sourced Secrets expire (6 or 12 months recommended in Composio's guide); plan rotation. [e2]
  • Sourced Choosing 'Allow all tenants' means any Microsoft organization can authenticate with your app. [e2]
  • Sourced Apps registered with a personal Microsoft account cannot be publisher-verified. [e1]
  • Sourced Client secrets expire: the maximum lifetime is 24 months and Microsoft recommends under 12. Calendar the renewal or your connection will fail one day. [e3][e4]
  • Sourced Redirect URIs are case-sensitive and must match the path of your running app exactly. [e6]
  • Sourced Wildcard redirect URIs are not supported for apps that sign in both personal Microsoft accounts and work/school accounts. [e7]
  • Sourced Microsoft recommends a certificate rather than a client secret before production. [e5]

If you get stuck

Sourced Users from another company see a warning or cannot consent

Likely cause: Unverified publisher on a multitenant app requesting permissions beyond basic sign-in.

Fix: Complete publisher verification, or ask the tenant admin to grant consent.

Escalate when: Tenant policy blocks all unverified apps and the admin will not grant consent. [e1]

Next actions

  • Register the app and test with your own tenant.
  • Start partner account verification early if other organizations will connect.

What was tested

Nothing here has been tested by hand yet.

What we are unsure about

  • Time to verify the Microsoft AI Cloud Partner Program account is not stated.
  • Admin consent flows and which Graph permissions require admin consent were not covered in this pass.
  • No hands-on test logged yet.

Sources

  1. [e1] Microsoft Learn - Publisher verification
    No charges are associated with completing the prerequisites for publisher verification.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  2. [e2] Composio - Microsoft Outlook OAuth2 credentials
    The client secret is Value not the secret ID.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  3. [e3] Microsoft Learn - Add and manage app credentials
    Client secret lifetime is limited to two years (24 months) or less.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  4. [e4] Microsoft Learn - Add and manage app credentials
    Microsoft recommends that you set an expiration value of less than 12 months.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  5. [e5] Microsoft Learn - Add and manage app credentials
    Microsoft recommends that you use a certificate instead of a client secret before moving the application to a production environment.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  6. [e6] Microsoft Learn - Redirect URI restrictions
    Redirect URIs are case-sensitive and must match the case of the URL path of your running application.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  7. [e7] Microsoft Learn - Redirect URI restrictions
    Wildcard URIs are currently unsupported in app registrations configured to sign in personal Microsoft accounts and work or school accounts.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  8. [e8] Microsoft Learn - Publisher verification
    Developers who have already met these requirements can be verified in minutes.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  9. [e9] Microsoft Learn - Publisher verification
    The developer must have a Partner One ID for a valid Microsoft AI Cloud Partner Program account that has completed the verification process.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  10. [e10] Microsoft Learn - Publisher verification
    a warning appears on the consent screen
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  11. [e11] Composio docs - Outlook toolkit, Authentication Details
    Composio-managed OAuth available
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page

Ask this guide

Questions about the ten library providers are answered from the guides, with the passage each answer rests on. For any other app it researches the web live and says so.

About the builder

Built by Moulshree Bhutra

Founding APM at Vudio.ai, applying for APM, Toolkits at Composio (Bangalore). This prototype is my answer to the take-home: a way for a developer to see the cost of an OAuth app before starting, and to trust what they read.

How I approached the problem

  • Started from what already exists. Composio publishes 46 setup guides. I read ten in full: they cover the clicking, but not setup time, difficulty or the approval wait, which is where teams lose weeks.
  • Designed for one decision. A developer asks "should I start this today?" So effort, wait, and what only you can do come first, and the steps come after.
  • Made trust visible. Every claim is tagged tested, sourced, reported, inferred or unknown, and quotes link to the page they came from. Where no provider states a number, the guide says so instead of guessing.
  • Kept the agent honest in code. The live agent cannot mark anything tested, and a quote it cannot find in a page it actually read is removed. The method page lists what was and was not checked.

Why I am a good fit

  • I have owned a product through integrations and AI. At Vudio.ai I worked across three roles as it grew from a video-commerce tool into an AI marketing platform with 10+ modules, including Shopify-connected widgets and the product side of its Campaign agent.
  • Results I can point to. I contributed to about 7x ARR growth ($30K to $0.2M) over two years through 0 to 1 launches. I redesigned Shoppable Widgets and built self-serve onboarding: activation rose about 74% and turnaround fell from 13 days to 4. I led AI Studio from 0 to 1 (ARPU up 5% among fashion brands) and built an analytics dashboard that lifted free-to-paid conversion about 10%.
  • I build to understand. I have a computer science degree and I prototype my own ideas, so I can talk to engineers about trade-offs. Top 3 of 200+ in NextLeap's Product Management Fellowship.
  • I write down what I do not know. This project lists its own gaps, including that the hands-on registrations are still being run.

Find me

Prototype built for the Composio APM, Toolkits take-home. It never asks for credentials or secrets.