Microsoft OAuth MCPs

1. Overview

This document walks through setting up various Microsoft OAuth MCPs:

Microsoft Teams MCP

Microsoft Outlook MCP

Azure DevOps MCP

Each integration uses OAuth 2.0 so that users authenticate with their own Microsoft identity and grant scoped access on their behalf. Ejento acts as the orchestration layer — handling token exchange and securely storing credentials so agents can act on behalf of users at runtime.

The steps required are the same across all three integrations:

Add the required API permissions to the existing app registration

Add the Ejento callback (redirect) URI

Provide Ejento with the Client ID, Tenant ID, and Client Secret

2. What Each MCP Enables

2.1 Microsoft Teams MCP

With the Teams MCP enabled, Ejento agents can:

Capability	Description
Read channels & teams	List teams and channels the user belongs to
Read channel messages	Retrieve messages from channels
Send & reply to messages	Post messages or replies
Read & write chat messages	Access and send direct messages
Access shared files	Work with files via Teams/SharePoint
Read team membership	Identify team members
Read user profiles	Retrieve user profile info

2.2 Microsoft Outlook MCP

With the Outlook MCP enabled, Ejento agents can:

Capability	Description
Read & write emails	Access and manage emails
Send emails	Send emails on behalf of the user
Read & write calendar events	Manage meetings and events
Read contacts	Access user contacts
Read user profile	Retrieve profile info

2.3 Azure DevOps MCP

With the Azure DevOps MCP enabled, Ejento agents can:

Capability	Description
Work items	Manage tasks, bugs, and stories
Repositories & PRs	Access code and pull requests
Pipelines & builds	Trigger and view builds
Boards & sprints	Access planning tools
Test plans	View test data
Project & team data	List projects and teams

Note: Access is limited to the permissions of the signed-in user.

3. App Registration Changes Required

3.1 Add Redirect URIs

Navigate to Authentication in each app registration and add:

Integration	Redirect URI
Outlook	`https://apim-ejento-manpowergroup-eastus2-001.azure-api.net/auth-service/api/v2/mcp-sso/outlook/callback`
Teams	`https://apim-ejento-manpowergroup-eastus2-001.azure-api.net/auth-service/api/v2/mcp-sso/teams/callback`
Azure DevOps	`https://apim-ejento-manpowergroup-eastus2-001.azure-api.net/auth-service/api/v2/mcp-sso/devops/callback`

3.2 API Permissions — Microsoft Teams

Add these Microsoft Graph Delegated Permissions:

Permission	Description
Channel.ReadBasic.All	Read channel metadata
ChannelMessage.Read.All	Read channel messages
ChannelMessage.ReadWrite	Read/write messages
ChannelMessage.Send	Send messages
Chat.ReadWrite	Chat access
Chat.ReadWrite.All	Full chat access
Files.ReadWrite.All	File access
Team.ReadBasic.All	Read teams
TeamMember.Read.All	Read members
User.Read	Basic profile
User.ReadBasic.All	Basic profiles

Note: Some require admin consent.

3.3 API Permissions — Outlook

Add these Microsoft Graph Delegated Permissions:

Permission	Description
Calendars.Read	Read calendars
Calendars.ReadWrite	Full calendar access
Contacts.Read	Read contacts
email	Access email address
Mail.Read	Read mail
Mail.ReadWrite	Read/write mail
Mail.Send	Send mail
User.Read	Profile access

3.4 API Permissions — Azure DevOps

Add:

Permission	Description
user_impersonation	Full access to Azure DevOps APIs

Steps:

Go to API Permissions

Click Add a permission

Select APIs my organization uses

Search Azure DevOps

4. Credentials Required

Provide the following:

Value	Location	Notes
Client ID	App Overview	One per integration
Tenant ID	App Overview	Usually same
Client Secret	Certificates & Secrets	Treat as password

Important: Share securely (not via email).

5. OAuth Setup on Ejento

Once setup, we will enable these connectors on Ejento. Once enabled, users authenticate with their own account, allowing the connectors to operate using that user’s information and access

Microsoft OAuth MCPs

1. Overview#

2. What Each MCP Enables#

2.1 Microsoft Teams MCP#

2.2 Microsoft Outlook MCP#

2.3 Azure DevOps MCP#

3. App Registration Changes Required#

3.1 Add Redirect URIs#

3.2 API Permissions — Microsoft Teams#

3.3 API Permissions — Outlook#

3.4 API Permissions — Azure DevOps#

4. Credentials Required#

5. OAuth Setup on Ejento#