Connect MS Graph
⚠️ MS Graph OAuth is currently disabled for email-style signals (
Mail.Read). Microsoft's equivalent of Google's Restricted-scope verification hasn't been completed yet, so the OAuth integration path is turned off. For Outlook / Microsoft 365 email, please connect via IMAP instead: see /docs/integrations/imap/setup. Same signal output; different transport. For 365 accounts with Modern Auth required (most), generate an app password under Microsoft account → Security → App passwords and paste that into PerfCopilot's IMAP form. (Teams meeting transcripts and calendar density remain available via the separate Teams / Zoom flows; see the call-quality docs.)
Microsoft 365 signals: per-employee Outlook email metadata and Microsoft Teams call-quality transcripts.
Prerequisites
- A Microsoft 365 account that the employee can sign in to (no Global Administrator role required: each employee consents for their own account)
- Managers can send a one-click invite link from Employees; recipients land on a magic-link page that triggers the OAuth flow
1. Generate credentials in MS Graph
MS Graph uses per-employee delegated OAuth, the same per-employee pattern as Gmail: there are no API tokens to copy. The employee completes the consent themselves, granting access only to their own account.
-
Sign in to https://app.perfcopilot.com as the employee whose Microsoft 365 account you're connecting.
-
Open Account → Integrations, find the MS Graph card, and click Connect.
-
Microsoft's consent screen opens in a popup. Sign in with the Microsoft 365 account you want to connect.
-
Approve the requested delegated scopes:
Mail.Read(email signals), plusOnlineMeetings.ReadandOnlineMeetingTranscript.Read.All(Microsoft Teams call-quality transcripts). PerfCopilot does not read message bodies: only sender / recipient / timestamp headers are used. There is no domain-wide admin consent and noUser.Read.All/Directory.Read.Allaccess.
Currently unavailable. This OAuth path is disabled while Microsoft's verification is pending. Connect Outlook / Microsoft 365 via IMAP instead.
Copy these values; you'll paste them in the next step:
- No fields: OAuth handles credentials.
2. Paste into PerfCopilot
-
Open Account → Integrations on your PerfCopilot account.
-
Find the MS Graph card and click Connect (or Manage if already configured).
-
Paste each value into the matching field:
Field in PerfCopilot Value from step 1 (none) No fields: OAuth handles credentials. -
Click Save.
3. Verify
Click Test in the drawer. Expected:
✅ Authenticated as your.name@your-tenant.onmicrosoft.com
If you see a red error, jump to Common errors.
Common errors
| Message | What it usually means | Fix |
|---|---|---|
AADSTS50020: User account from identity provider does not exist | The employee signed in with a personal Microsoft account or a guest account on the wrong tenant. | Sign back in with the work Microsoft 365 account on the correct tenant. |
Scope changed since consent | Microsoft requires fresh consent whenever PerfCopilot's requested scope set changes. | Click Connect again; the new consent screen will list the updated scopes. |
HTTP 401: InvalidAuthenticationToken | The refresh token expired or was revoked from Azure AD. | Re-run the Connect flow to mint a fresh token. |
What signals we pull
email: sent / received metadata per employee from Exchange Online (headers only, no bodies).- Microsoft Teams meeting transcripts, used for call-quality scoring.
Need a feature you don't see? Tell us →.