Set Up the Outlook (Service Account) ConnectorProfessional

The Outlook (Service Account) Connector allows you to ingest emails and attachments from Exchange Online mailboxes into your project using application authentication (Microsoft Entra client credentials) instead of signing in as a user. It is a separate connector from the Outlook Connector, built for organizations that cannot grant delegated user consent and can only approve application-level permissions.

Because the connector authenticates as an application, there is no signed-in user and no personal mailbox: you explicitly list the mailboxes to ingest, and your app registration must be granted access to each of them.

How it differs from the Outlook Connector:

Configure Your Azure AD App

This one-time setup is performed by an Azure administrator in the Microsoft Entra tenant that owns the mailboxes.

1. Register Your Application in Azure AD

1. Navigate to Azure Portal > Microsoft Entra ID > App registrations.
2. Click New registration.
3. Configure the application details:
   • Name: Enter a descriptive name, such as Airia Outlook Ingestion.
   • Supported account types: Select Accounts in this organizational directory only.
   • Redirect URI: Leave empty. There is no interactive sign-in for this connector.
4. Click Register.
5. From the app's Overview page, save the Application (client) ID and the Directory (tenant) ID. You will need both later.

2. Configure API Permissions

1. In your registered application's left menu, navigate to API permissions.
2. Click Add a permission.
3. Select Microsoft Graph.
4. Choose Application permissions.
5. Add the following permissions:
   • Mail.Read
   • User.Read.All
6. Click Add permissions.
7. Click Grant admin consent for [Your Tenant Name] and confirm. Application permissions do not take effect without admin consent.

3. Obtain Your Client Secret

1. In your registered application's left menu, navigate to Certificates & secrets.
2. Click New client secret.
3. Provide a Description (e.g., Airia Client Secret) and set an appropriate Expires duration.
4. Click Add.
5. Copy the Value of the client secret immediately. It will only be shown once and is required for the Airia credential.

⚠️ Warning: When the client secret expires or is rotated in Azure, syncing stops until you update the credential in Airia. Track the secret's expiry date.

4. Limit Mailbox Access (Recommended)

By default, the application-level Mail.Read permission grants your app registration read access to every mailbox in the tenant. Airia only reads the mailboxes you list on the data source, but we strongly recommend restricting the app registration itself to those mailboxes using an Exchange Online application access policy (New-ApplicationAccessPolicy) or Role Based Access Control for Applications.

Create the Credential in Airia

1. In Airia, go to Settings > Ecosystem > Credentials.
2. Click Add credentials.
3. Select Microsoft Graph Access Token as the Credential Type.
4. Fill in the values you saved from Azure:
   • Azure Tenant ID: The Directory (tenant) ID.
   • Azure Client ID: The Application (client) ID.
   • Azure Client Secret: The client secret value.
5. Select the Project within Airia where you want to use this credential. The credential must be visible to the project where you will create the data source.

Create an Outlook (Service Account) Data Source

1. Add a Data Source

1. In the Airia platform, navigate to Available data sources.
2. Select the Outlook (service account) card.

2. Configure Data Source Details

1. Provide the following details:
   • Name: A mandatory, descriptive name for your data source (e.g., Support Mailbox Data).
   • Description: (Optional) A brief description up to 1000 symbols.
   • Scope: Select the Airia project for this data source.
   • Microsoft Graph application credential: From the dropdown, select the credential you created above. There is no authentication step — the stored credential is the only authentication input.
   • Mailboxes: Enter one mailbox address per line (e.g., [email protected]). At least one mailbox is required, and your app registration must have access to each of them in Exchange Online.

3. Specify Ingestion Settings

(Optional) Configure the ingestion settings based on your specific use case and data requirements. More info can be found under Ingestion settings.

4. Select Folders and Start Ingestion

Browse and select the content you want to ingest.

• Click Next. The content selector opens, listing the mailboxes you configured. Unlike the Outlook Connector, one data source can ingest multiple mailboxes.
• Select a whole mailbox to sync everything in it, or expand a mailbox and select specific folders. Selecting a folder syncs it and all of its subfolders.
• At least one selection is required.

💡 Tip: Selecting a mailbox or folder will sync all supported content within it, including emails, subfolders, and attachments. Reprocessing the data source will automatically sync newly added content, update modified content, and delete removed items within the selected content. This also applies to configuration changes: if you remove a mailbox or deselect a folder, its previously ingested emails and attachments are removed on the next sync.

💡 Note: The Drafts, Deleted Items, Junk Email, and RSS Feeds folders are always excluded and cannot be selected.

What Gets Ingested

• Emails: Each message in a selected folder is ingested as one document, including the message body and metadata (sender, recipients, cc, bcc, subject, dates, and conversation).
• Attachments: File attachments are ingested as separate documents alongside their parent message. Standard per-file-type ingestion size limits apply. Attached emails, calendar items, and cloud file links are not ingested.

Permissions

The Outlook (Service Account) connector does not support per-user permission enforcement. An application credential carries no end-user identity, so there is nothing to filter search results against — the Check file permissions option is not available for this connector type.

Every user with access to the data store can retrieve content from all ingested mailboxes. Scope the configured mailboxes accordingly: this connector is intended for shared or functional mailboxes, not for ingesting the personal mail of many users into one store.

For connectors that support permission enforcement, see Permissions Enforcement.

Troubleshooting

Next Steps

After your data has been successfully ingested, you can view the ingested emails and their attachments in the data source file list view. Airia captures the relationships between senders, receivers, emails within a thread, and their attachments in a dedicated knowledge graph for your data source.

To leverage this knowledge and enable your Agent to answer complex questions (e.g., "Who sent the last email for a specific thread?", "What was the last email by John Doe?", or "How many emails do I have from John Doe?"), you need to configure an Airia native Query Graph DB tool.

1. Configure the Graph Database Cypher Query Tool
   1. Navigate to the MCP & Tools tab within your project.
   2. Select New tool.
   3. Search for Graph Database Cypher Query and select it from the library.
   4. Provide a meaningful Name for the tool for easy tracking.
   5. From the Select an existing Graph dropdown, choose the name of your Outlook (service account) data source.
   6. The tool is now ready to be attached to an LLM within an Agent.

💡 Note: To retrieve semantically relevant information from this data source, you still need to use the data search step in addition to the Graph Database Cypher Query tool.