Skip to main content
Setting up Microsoft 365 for agents means a lot of Microsoft Graph API calls: finding site, drive and folder IDs, granting an app registration access to exactly the right folder, consenting permissions, publishing and installing a Teams app. The Microsoft 365 Admin capability lets a workspace admin hand that work to an agent while keeping every action under their own approval and their own Microsoft account.
Microsoft 365 Admin is currently enabled per workspace on request. Contact support@abundly.ai to turn it on for your workspace.

​
How it works

  1. You tell the agent what you want, for example “give the Contracts agent read access to the Recordings folder on the Legal site”.
  2. The agent proposes a plan: an ordered list of Graph requests, each with a one-line purpose, plus the Microsoft permissions the plan needs. The plan appears as a card in the chat.
  3. You click Approve via Microsoft. Microsoft asks you to sign in and consent to exactly those permissions for your own account, and issues a temporary token. Back in the chat you click Run plan.
  4. The platform runs the plan’s requests, exactly as shown, and hands the responses back to the agent. The agent reports what happened.
A plan can look something up and use the answer in a later step, so finding a site’s ID and granting access to it fits in one approval. When you’d rather see the literal IDs before anything changes, ask the agent for a read-only plan first and a write plan after.

​
Example use cases

  • “Grant the Recordings agent read access to the Meetings folder on the Legal site” — the folder-scoped grant behind SharePoint app-only mode
  • “Which sites has our Abundly app registration been granted, and at what level?”
  • “Revoke the site-wide grant so the folder grant is the only thing left”
  • “Consent the Sites.Selected application permission on our app registration”
  • “Register a new Entra app for the Contracts agent’s SharePoint connection and store its client secret for me”
  • “Mint a new client secret for our Teams bot, publish its Teams app to our org catalog and install it in the Engineering team”

​
What makes it safe

No standing credential. The platform never holds a long-lived admin credential for your tenant. Each sign-in mints an access token for your own Microsoft account with only the permissions the plan lists and no refresh token. Microsoft expires it within about an hour, and the platform deletes it at the same moment.
  • Your account, your limits. The token acts as you, so the agent can never do anything you could not do yourself. Microsoft’s sign-in and audit logs show your account and the Abundly app.
  • The plan is immutable. What you read on the card is exactly what runs. The agent cannot add or change steps after you approve; if it wants something different, it proposes a new plan for a new approval.
  • Chat only. The sign-in is bound to you, this agent and this chat. Scheduled triggers, incoming emails and other agents cannot use it.
  • Fixed permission list. The agent can only ask for a fixed set of delegated Graph permissions covering SharePoint, Entra app registrations and Teams administration. Anything else is rejected before you see it.
  • Secrets never pass through the chat. When a plan creates a credential, such as a client secret for a new app registration, the step declares which response field is the secret. The platform writes it straight into Workspace → Secrets, encrypted, and replaces it with a marker before the agent, the chat or any log sees the response. Neither you nor the agent ever reads the value; you just pick the secret by name in the capability that needs it.
  • Reuse within the hour. Several plans in the same chat share one token, so a discovery plan followed by a write plan needs one trip through Microsoft, not two. Click Revoke now on any plan card to drop the token early.

​
Prefer to run it yourself?

Every plan card also offers Run it yourself in PowerShell instead. That downloads the same plan as a PowerShell script, one Graph call per step, that you review and run in your own terminal. It signs you in through Microsoft’s own Graph command-line app, so no token of yours ever reaches Abundly, and no Abundly app registration is needed in your tenant. When it finishes, it prints a results block to paste back into the chat and, separately, any secret it created, which you add under Workspace → Secrets rather than pasting into the chat. PowerShell 7 runs on Windows, macOS and Linux; the script installs the one small Microsoft Graph module it needs. Run it with:

​
Setup

The capability is only available on agents whose User access is set to Workspace admins only.
  1. Create or pick an agent and set its User access to Workspace admins only.
  2. Enable Microsoft 365 Admin on the agent’s Capabilities page. No credentials are needed.
  3. Start a chat and describe the change you want.
Your Microsoft account needs the rights for the change itself. For example, granting a folder requires that you can manage permissions on that folder; Microsoft refuses otherwise and the agent reports the refusal.
If your organisation limits how long access tokens live, a shorter lifetime applies here too. A ten-minute token lifetime policy works well with this capability.