# Outlook MCP server or its own inbox: which should your agent use?

Connect your agent to Outlook when the task is *your* mail: triage,
summaries, drafts you send yourself. Give it its own inbox when it acts on
its own: signing up for tools, chasing vendors, receiving codes. With
Outlook, the agent works inside your Microsoft account through Microsoft
Graph, and at work that account belongs to your organization, so your IT
admin's rules apply too.

## How agents reach Outlook

Every Outlook route, from a community "Outlook MCP server" to Microsoft's own
tools, goes through Microsoft Graph mail permissions:

| Permission | Delegated (acts as you) | Application (no signed-in user) |
| --- | --- | --- |
| `Mail.ReadBasic` | Read your mail except body, preview and attachments | The same, in **all mailboxes** |
| `Mail.Read` | Read your mailbox | Read mail in **all mailboxes** |
| `Mail.ReadWrite` | Create, read, update and delete your mail (not send) | The same, in all mailboxes |
| `Mail.Send` | Send mail as you | Send mail as **any user** |

Application permissions need admin consent. Microsoft notes that
administrators can use an application access policy to limit an app to
specific mailboxes; without one, an app-only agent can reach every mailbox in
the tenant. Delegated permissions are available to personal Microsoft
accounts as well as work accounts. Source: Microsoft's
[Graph permissions reference](https://learn.microsoft.com/en-us/graph/permissions-reference),
checked in October 2026.

**Microsoft's Mail MCP server** (`mcp_MailTools`, in preview) exposes Graph
mail as tools: create, get, update and delete messages, search with KQL,
send mail as the signed-in user, reply, reply-all and send drafts. Microsoft's
own note says these app-specific Microsoft 365 MCP tools are "only intended
for backward compatibility" and points new projects to Work IQ MCP. See the
[Mail reference](https://learn.microsoft.com/en-us/microsoft-agent-365/mcp-server-reference/mail).

## Work accounts change the question

A personal Gmail decision is yours alone. An Outlook work mailbox isn't:

- **Your organization's data.** Client threads, HR mail and shared folders
  sit in the same mailbox. An agent with `Mail.Read` sees all of it.
- **Your name on every send.** `Mail.Send` sends as you, to colleagues and
  customers, from the company domain.
- **Admin policy.** Application permissions always need an admin's consent,
  and your organization's policies may require IT to approve any app that
  reads mail, so an Outlook MCP server may not work until they do.
- **Prompt injection.** Anyone outside the company can email you. A message
  written to manipulate an agent arrives next to real mail, and an agent that
  can read and send could act on it.

With its own address, the agent only sees mail sent to it, and nothing it
sends comes from you.

## Side by side

| | Botmail | Your Outlook via Graph or MCP |
| --- | --- | --- |
| Address | The agent's own, such as `ada@botmail.pro` | Yours, often on your company's domain |
| What the agent can read | Mail sent to its address | Your whole mailbox (or every mailbox, with app permissions) |
| Who mail comes from | The agent | You |
| Setup | Paste one prompt, approve one email | An app registration and consent, often an admin's |
| Review before sending | Drafts with a review link | Drafts in Outlook |
| Daily sending | Up to 1,000 a day free (100 at first) | Exchange Online: 10,000 recipients a day, 30 messages a minute |
| Your own domain | Not yet | Yes |

Exchange Online limits are from Microsoft's
[Exchange Online limits](https://learn.microsoft.com/en-us/office365/servicedescriptions/exchange-online-service-description/exchange-online-limits)
page, checked in October 2026.

## Choose your Outlook if

- the job is your existing mail: sorting, summarizing, finding things
- you review and send every draft yourself
- mail has to come from your company address, and IT has approved the app

## Choose Botmail if

- the agent signs up for services or runs its own conversations
- you don't want it near your work mailbox, or can't get admin consent
- you want mail from the agent to be clearly from the agent

Plenty of people use both: Copilot or an Outlook connector for their own
inbox, and a separate address for anything the agent does on its own. The
same reasoning for Google accounts is in
[Gmail API vs its own inbox](https://botmail.pro/compare/gmail-api).

Botmail isn't affiliated with Microsoft.

## Try Botmail

Paste this into your agent:

```text
Read https://botmail.pro/skill.md and claim a mailbox for yourself. Send the invite to my email, then wait for me to approve it.
```

## Questions

### Is there an official Outlook MCP server?

Microsoft has a Mail MCP server (mcp_MailTools) in preview that exposes Graph mail tools such as search, send, reply and drafts. Microsoft says these app-specific tools are for backward compatibility and points new projects to Work IQ MCP.

### What permissions does an AI agent need to read and send Outlook mail?

Through Microsoft Graph, Mail.Read to read and Mail.Send to send as you. The application versions of those permissions cover all mailboxes in the organization and need admin consent.

### Is it safe to connect an AI agent to my work Outlook?

It gives the agent your whole mailbox and lets it send as you, and an email written to manipulate it can arrive like any other. Check your organization's policy first, and use a separate address for tasks the agent does on its own.

---

Source: https://botmail.pro/compare/outlook
Agent instructions: https://botmail.pro/skill.md
All guides: https://botmail.pro/llms.txt