Microsoft 365 Setup

What you get

Connecting Microsoft 365 gives AIDA access to:

• Outlook — read, search, send, and manage emails
• Calendar — view and create calendar events
• Tasks — manage Microsoft To Do tasks
• OneDrive — search and read files
• OneNote — access and create notes
• Excel, Word, PowerPoint — create and edit Office documents

Before You Start

You need:

• A Microsoft account (personal, work, or school)
• Access to the Azure Portal — free with any Microsoft account

Step 1 — Sign in to the Azure Portal

1. Go to portal.azure.com
2. Sign in with your Microsoft account
3. You are now in the Azure Portal home screen

Step 2 — Register a New App

1. In the search bar at the top, type App registrations
2. Click App registrations from the results
3. Click + New registration
4. Fill in the form:
   • Name: AIDA (or any name you prefer)
   • Supported account types: Select Accounts in any organizational directory and personal Microsoft accounts
   • Redirect URI: Select Web from the dropdown, then enter:
     ``
https://YOUR-DOMAIN/api/microsoft/callback
`
> Replace YOUR-DOMAIN with the domain where your AIDA is installed (e.g. aida.yourbusiness.com`). It must be https with a real domain — a bare server IP will not work.
5. Click Register

You will be taken to your new app's overview page.

Step 3 — Copy Your Client ID

On the app overview page, you will see:

• Application (client) ID — copy this, you need it later
• Directory (tenant) ID — copy this too

Step 4 — Create a Client Secret

1. In the left sidebar, click Certificates & secrets
2. Click + New client secret
3. Enter a description — e.g. "AIDA Secret"
4. Set expiry — choose 24 months (longest option)
5. Click Add
6. Copy the secret Value immediately — it looks like a long random string

Step 5 — Add API Permissions

1. In the left sidebar, click API permissions
2. Click + Add a permission
3. Click Microsoft Graph
4. Click Delegated permissions
5. Search for and add each of these permissions:
   • Mail.Read
   • Mail.ReadWrite
   • Mail.Send
   • Calendars.Read
   • Calendars.ReadWrite
   • Tasks.Read
   • Tasks.ReadWrite
   • Files.ReadWrite.All
   • Contacts.Read
   • Contacts.ReadWrite
   • Notes.ReadWrite.All
   • User.Read
   • offline_access
6. Click Add permissions
7. Click Grant admin consent for [your account] — then click Yes

Step 6 — Configure in AIDA

1. Open AIDA → Settings
2. Scroll down to Microsoft 365
3. Enter your credentials:
   • Client ID — paste the Application (client) ID from Step 3
   • Client Secret — paste the secret Value from Step 4
   • Tenant ID — paste the Directory (tenant) ID from Step 3
4. Click Save
5. Click Connect Microsoft 365
6. A Microsoft sign-in window will open
7. Sign in with your Microsoft account
8. Accept the permissions request
9. The window will close and show Connected in green

Step 7 — Test the Connection

Ask AIDA in chat:

• "Check my Outlook inbox"
• "What's on my Microsoft calendar today?"
• "List my To Do tasks"

Troubleshooting

"Access blocked" or "Admin approval required" — Your organization's IT policy requires admin approval. Ask your IT admin to approve the app in Azure Portal → Enterprise Applications.

"Invalid client secret" — The secret may have been copied incorrectly or has expired. Go back to Azure Portal → your app → Certificates & secrets → create a new secret.

"Insufficient privileges" — Make sure you added all the required API permissions in Step 5 and clicked Grant admin consent.

Token expired — AIDA refreshes tokens automatically. If you see this error repeatedly, go to Settings → Microsoft 365 → Disconnect, then reconnect.

Client secret expiry — Client secrets expire (you set this in Step 4). When it expires, create a new secret in Azure Portal and update it in AIDA Settings. Set a reminder before the expiry date.

Security Notes

• Your credentials are stored securely in AIDA's database on the server
• Tokens never leave your server
• You can revoke access anytime at myaccount.microsoft.com/permissions or by disconnecting in AIDA Settings
• The client secret only gives access to accounts that explicitly authorize it — nobody else can use your app registration