Microsoft

Vendor ID: microsoft · Maturity: preview · microsoft.com · docs.microsoft.com · Categories: productivity, storage

Microsoft 365 productivity tools (Calendar, Excel, OneDrive, Outlook, Planner, SharePoint, Teams).

Auth

Products

Calendar scopes: microsoft:calendar requests Calendars.ReadWrite, Calendars.Read.Shared, and Calendars.ReadWrite.Shared. A Microsoft connection created before Calendar or shared-resource support was enabled won't carry these scopes — reconnect the account (an Entra admin may need to re-consent) so calendar calls don't return 403.

Shared mailboxes and calendars

A shared mailbox does not sign in to Scrydon. A licensed Microsoft 365 user signs in and acts as the connection's execution account; Exchange then delegates that user access to mailboxes such as hello@example.com.

For a promotable workflow, configure one exact Microsoft connection per workspace environment:

The mailbox address stays the same. OAuth accounts, access tokens, and refresh tokens remain local to each environment and are never promoted.

Configure delegated access

1. In Exchange, grant the execution account Full Access to the shared mailbox. To send with only the shared address visible, also grant Send As. Send on Behalf works, but recipients see the delegate relationship.
2. For shared calendars, grant the execution account the required Exchange calendar delegation.
3. In Entra, grant the delegated Graph scopes required by the product, then reconnect the account if the connection predates these scopes:
   • Outlook: Mail.Read.Shared, Mail.ReadWrite.Shared, Mail.Send.Shared
   • Calendar: Calendars.Read.Shared, Calendars.ReadWrite.Shared
4. Under Organization settings → Integrations, create an exact connection for each environment, connect the licensed identity, and designate it as the execution account.
5. Under the workspace's Integrations → Execution credentials, assign that execution account and add the exact mailbox address. Scrydon performs a live Graph read probe before saving the assignment. Microsoft does not expose a complete list of delegated shared mailboxes, so entering the address manually is expected.
6. In the workflow block, select the environment connection by name under Microsoft Account, then choose the assigned address under Mailbox. Choose Execution account default to intentionally use the execution account's own /me mailbox or calendar.

Select an account and mailbox in the canvas

The Outlook and Calendar blocks keep identity and target separate:

• Microsoft Account selects the identity whose Microsoft token authorizes the call.
• Mailbox selects the mailbox or calendar owner that the call targets.

With a personal delegated account, choose My mailbox for /me, or type the exact shared address into the Mailbox field and pick Use <address> — the address is saved immediately. Microsoft Graph does not reliably enumerate every mailbox delegated to a user, so Scrydon then runs a live Graph read probe with that account in the background and shows a warning on the field when access cannot be verified. With an environment or app-only account, the Mailbox list contains only resources assigned centrally to that workspace credential.

The fields come from the integration product's generic resource declaration; they are not Outlook-specific workflow fields. Products with one declared resource use the same account/resource pattern.

Promotion behavior

Environment-bound workflows store the product and selected resource, not a Microsoft account ID. Promotion keeps hello@example.com unchanged and checks that the target environment has:

• an exact (not wildcard) Microsoft connection;
• a designated execution account that does not require reauthorization;
• the required delegated scopes;
• a workspace assignment for the same mailbox resource; and
• a successful Graph access probe when the resource is assigned.

Promotion stops with an actionable error when a prerequisite is missing. Workflows pinned to an explicit personal account continue to use that account; any selected shared address is verified live with the personal account when the workflow runs.

Sending and Sent Items

For a selected mailbox, Scrydon sends through /users/{mailbox}/sendMail and sets the message from address to that mailbox. With Full Access plus Send As, recipients see the shared mailbox address. Microsoft documents that this endpoint defaults to the from mailbox's Sent Items folder; Exchange administrators can change or duplicate that behavior with the mailbox's sent-item copy settings. See Send Outlook messages from another user and configure shared-mailbox Sent Items.

Scrydon can verify Mail or Calendar read access without changing data. There is no non-sending Graph probe for Send As; the definitive test is a real send. If Microsoft returns ErrorSendAsDenied, grant Send As or Send on Behalf and confirm Full Access.

Triggers

Outlook shared-mailbox new-email triggers use polling with the environment's execution account and selected mailbox. They are not real-time: delegated .Shared permissions cannot create Microsoft Graph change-notification subscriptions for another user's shared mail folders. Polling maintains a separate cursor per workflow trigger. Teams and SharePoint continue to use their supported webhook behavior. See the Triggers section.

Shared-resource troubleshooting