Connect a Microsoft 365 mailbox
Connect a work Microsoft 365 mailbox to Muin via OAuth so inbound email lives in the unified comms hub alongside donor receipts. Read-only — Muin does not send from your address.
Connect a work Microsoft 365 mailbox to Muin so the messages you already receive in Outlook show up alongside donor receipts and replies in the unified comms inbox. Connection is per-user — each teammate connects their own mailbox.
Read-only. Muin syncs mail in. It does not send from your address, and you can’t reply to a synced thread from inside Muin yet — reply from Outlook as usual. Only new mail is synced; messages received before you connect stay in your mailbox.
Visibility. Mail synced from a connected mailbox is readable by everyone on your team who can open the shared comms inbox — it is not private to you. Connect a mailbox only if that’s what you want.
Prerequisites
- A Microsoft 365 (work or school) account. Personal Outlook.com accounts also work via the same flow. Free, non-Microsoft mail (Yahoo, AOL, etc.) is not supported here. If you want to send from a custom domain, use a BYO branded sender — no mailbox connection sends mail.
- Your organization’s Microsoft 365 admin must have granted Muin tenant-wide consent at least once. If they haven’t, you’ll see “Need admin approval” the first time you try to connect — share the admin consent runbook with your IT.
- Muin tier: any tier with the Communications Hub enabled.
Step-by-step
- Sign in to Muin and go to Settings → Communications →
Connected mailboxes, or open the wizard directly at
/settings/communications/mailbox/connect. - Choose Microsoft 365 on the provider-select step. The consent screen shows you exactly what Muin will and won’t access.
- Click Connect Microsoft 365. Microsoft signs you in and shows you a permissions screen. Review and click Accept.
- Pick which folders Muin syncs (default:
Inbox). You can change this later from Settings → Communications → Connected mailboxes. - Muin starts a one-time backfill of the most recent 100 messages so the inbox isn’t empty. New mail then syncs every 5 minutes via Microsoft Graph delta queries.
What Muin can see
| Permission | Scope | What we use it for |
|---|---|---|
Mail.Read |
Mail in the folders you select | Show your inbound mail in the unified comms inbox; thread replies; let AI suggest drafts. |
User.Read |
Your name and email | Identify which mailbox connected; populate the connected-accounts list. |
offline_access |
Refresh tokens | Keep the mailbox synced without asking you to sign in every hour. |
We do not request Mail.Send. Muin never sends from your address, so
we don’t ask for permission to.
We do not request access to your calendar, contacts, OneDrive files, Teams chats, or any other Microsoft 365 service.
Privacy
- Tokens are encrypted at rest with our platform KMS — see the security overview.
- Email metadata (sender, recipient, subject, message-id) is stored in your tenant database for the unified inbox.
- Muin never logs full message bodies in operational logs. PII addresses
are masked (
mask_email) in audit and observability streams. - Mailbox connections are made per-user, but synced mail is not private to you: messages from a connected mailbox appear in your organization’s shared comms inbox and can be read by any teammate with access to it. Per-user message isolation is planned, not current — connect a mailbox only if team-wide visibility is what you want. (The separate admin team-mailbox view shows connection metadata only: who connected, last sync, sync status.)
Troubleshooting
| Symptom | Action |
|---|---|
“Need admin approval” / AADSTS65001 error |
Your IT admin hasn’t granted consent. Share the talking points from our Microsoft admin consent runbook — they grant consent once, then your whole team can connect. |
| Connected but no messages appear | Check Sync status on the Connected Mailboxes page. If error, click the Get help link to open a tagged support ticket — we’ll work the email-mailbox-sync-error runbook. |
| “Unverified app” warning | Azure publisher verification is in flight (free, ~1 week). The warning is cosmetic and doesn’t affect the connection. It clears once verification completes. |
For your IT admin: granting tenant-wide consent
Send this to your Microsoft 365 admin once. They grant consent at:
https://login.microsoftonline.com/<your-microsoft-tenant-id>/adminconsent?client_id=<muin-client-id>&redirect_uri=https://muin-api.falaah.ai/api/v1/email-mailbox/oauth/microsoft/callbackReplace <your-microsoft-tenant-id> with your Microsoft 365 tenant ID. The
Muin client ID is shown on the in-app setup screen.
After consent, every teammate in your organization can connect their mailbox without seeing the admin-approval gate.
Disconnecting
Disconnect any time at Settings → Communications → Connected mailboxes → Disconnect. We clear OAuth tokens immediately and stop syncing. You choose whether to delete already-synced messages or keep them in your comms hub history.