Outlook Setup Beta

Connect your own Microsoft Outlook mailbox so the agent can find and read your email, save drafts, and send messages on your behalf from Explore chat and your MCP clients. You can also give it read access to shared mailboxes and former-employee mailboxes you already have Full Access to in Exchange.

Unlike most Junto integrations, Outlook is not set up by an administrator for the whole organization. Each technician connects their own mailbox, and only that technician can use it.

Personal Connections

A personal connection belongs to one person, not to the organization.

• Only you can use it. The agent acts as you, on your mailbox, only when you are the one asking: in your own Explore chats in the Junto web app, or from an MCP client signed in as you. Other members of your organization cannot use your connection, even administrators.
• It never runs unattended. Runbooks, automations, workspaces, code mode, and Explore conversations held over Slack or Teams direct messages cannot use personal connections. If the agent is asked to use one from any of those places, it declines and explains why.
• It lives on the My connections page, not on Settings > Integrations. Open your avatar menu and choose My connections. The page explains the rule in one line: "Accounts you connect here belong to you. Only you can use them, from your own Explore chats and MCP clients. Automations, runbooks and other members of your organization never can."
• Any staff role can connect one. Technicians, Operators, Managers, Administrators, and Owners can all connect Outlook. Customer contacts cannot own a personal connection.
• Admins see that it exists, not what is in it. Administrators get a Personal connections card under Settings > General that lists which members have connected an account, when, and whether it is active, so they can offboard people. It never shows the connected account, its mail, or which other mailboxes you added, only how many.

Prerequisites

• A Junto account with the Technician role or higher
• A Microsoft 365 work or school account with an Exchange Online mailbox
• To read other mailboxes: Full Access to each shared or former-employee mailbox, granted to your account in Exchange by your Microsoft 365 administrator

Depending on your Microsoft 365 tenant's settings, an administrator may need to approve the permissions Junto requests the first time someone in your tenant connects.

Step 1: Connect Your Mailbox

1. In Junto, open your avatar menu and click My connections.
2. On the Outlook card, click Connect.
3. A Microsoft sign-in window opens. Microsoft always asks you to choose an account, even if you are already signed in elsewhere, so pick the mailbox you want Junto to use.
4. Review and accept the permissions. Junto asks to read your mail, create and update messages (for drafts), send mail as you, read mail in other mailboxes you have access to (for shared mailboxes), sign you in and read your basic profile, and keep that access without asking you to sign in again.
5. Back in Junto, the card shows Finishing... for a few seconds, then Connected, with the email address of the account you signed in with.

Once connected, the card reads "Let Junto read, draft and send email from your own mailbox in Explore and MCP. Every send waits for your approval." You can connect one Outlook account at a time.

Step 2: Shared and Former-Employee Mailboxes

When your Outlook connection is active, an Other mailboxes section appears below it on the My connections page: "Read shared or former-employee mailboxes you were given Full Access to in Exchange. Junto can only read them; drafts and sends always use your own mailbox."

This uses ordinary Exchange mailbox delegation in your own Microsoft 365 tenant. It does not require Junto's Exchange Online Delegation add-on, which manages permissions in your customers' tenants.

Get Access in Exchange

Ask your Microsoft 365 administrator to grant your account Full Access to the mailbox, for example a departed colleague's mailbox or a shared department mailbox such as support@. Junto checks this permission in Exchange when you add the mailbox and again on every read.

Add the Mailbox in Junto

1. Under Other mailboxes, enter the mailbox's Email address.
2. Enter a Name you will use to refer to it, such as Jane Doe (former employee) or Support inbox. Names cannot contain @ and must be unique in your list.
3. Click Add mailbox. The button shows Checking access... while Junto confirms in Exchange that your account can open that mailbox. If it cannot, nothing is saved and the error tells you what to fix.

You can add up to 25 other mailboxes. You cannot add your own mailbox; it is already connected. To stop reading a mailbox, click the remove icon on its row.

How the Agent Finds Them

The agent can list the mailboxes you can read: Your mailbox plus every mailbox you added, by name and address. It can only read mailboxes on that list, so it can never probe an address you did not add. Refer to a mailbox by the name you gave it: "Search Jane Doe's mailbox for the Contoso renewal."

Other mailboxes are strictly read-only. The agent can list, search, and read messages in them, but every draft and every send always comes from your own mailbox.

What the Agent Can Do

Capability	What Junto can do	Risk level
List mailboxes	Show your own mailbox and the other mailboxes you added, so you and the agent know which names to use	Low
List messages	List messages in a folder (Inbox by default; also Sent Items, Drafts, Archive, Deleted Items, Junk Email, or any folder), newest first, optionally only unread or only from a specific sender, in your mailbox or an added mailbox	Medium
Search messages	Search across all folders with free text or Outlook search syntax such as from: and subject:, ranked by relevance, in your mailbox or an added mailbox	Medium
Read a message	Open one message: sender, To and Cc recipients, dates, a link to it in Outlook, and the body as plain text (long bodies are cut at 20,000 characters and marked as truncated)	Medium
Save a draft	Create a new email in your own Drafts folder with To, Cc, subject, and a plain-text body. Nothing is sent; you review and send it from Outlook	Low
Send an email	Send a new email from your own mailbox with To, Cc, and Bcc recipients (up to 25 each, 50 in total), a subject, and a plain-text body. A copy is saved to Sent Items	High

The agent prefers saving a draft unless you explicitly ask it to send, so you can review the message in Outlook first. Drafts and sends write to your own mailbox only; the agent cannot reply to or forward an existing thread, move or delete messages, or write to an added mailbox.

Approvals

Saving a draft stays inside your own Drafts folder, so it runs without approval, like a read.

All send actions require technician approval before execution. Before any email leaves your mailbox, the agent shows you an approval card with every recipient, the subject, and the complete message body, and nothing goes out until you approve exactly that. Because the email is sent as you, the approval is yours alone:

• It is never routed to another approver, and no other member can approve a send from your mailbox.
• No organization approval policy, per-session approval, or risk-based auto-approval setting on the MCP page can skip it.
• The approved recipients, subject, and body cannot be edited during approval. If anything should change, decline and ask again.
• If you reconnect Outlook between approving and sending (for example to a different account), the send is cancelled and the agent asks you to review it again against the mailbox that is connected now.

Scope and Reporting

• Explore chat and MCP only. Outlook tools are available in your Explore chats in the Junto web app and in MCP clients such as Claude or ChatGPT connected with MCP. They are never available to runbooks, automations, workspaces, or code mode, and they do not run in Explore conversations held over Slack or Teams.
• One person's mailbox. Every call acts as you, through the account you connected. The connection is not tied to a customer company, so it works in any Explore chat whether or not a company is selected.
• What administrators can see. The Personal connections card on Settings > General shows each member's connection, the date it was connected, its status, and how many other mailboxes they added. The audit log records that Outlook was connected and that a mailbox was added or removed, not which one. Tool activity is logged with content-free summaries such as "Search your Outlook mailbox" or "Send an email from your Outlook mailbox to 2 recipients"; message contents, subjects, and recipients are shown only to you on the approval card.
• Exchange stays in charge. Microsoft enforces your permissions on every call. If your Full Access to a mailbox is removed in Exchange, reads of that mailbox stop working immediately, even if it is still on your list.

Example Requests

• "What unread emails came in this morning?"
• "Search my mailbox for anything from alex@contoso.com about the firewall renewal and summarize the latest message."
• "Draft a reply to the Northwind ticket owner explaining the maintenance window; I'll send it from Outlook."
• "Send an email to pat@contoso.com with the subject 'Server reboot tonight' confirming the 9 PM window."
• "Which mailboxes can you read?"
• "Look in Jane Doe's mailbox for the last invoice from Fabrikam."
• "Check the Support inbox for any messages from Contoso in the last week."

Managing the Connection

• Reconnect -- If your Microsoft sign-in expires or is revoked (for example after a password change or an administrator resets your sessions), the Outlook card shows "Your sign-in expired. Reconnect to keep using it." and the button reads Reconnect. Click it and sign in again. The agent also tells you when a connection needs to be reconnected instead of retrying.
• Switch accounts -- Click Disconnect, then Connect, and choose a different account in the Microsoft window. The previous account's credential is revoked.
• Disconnect -- Click Disconnect on the Outlook card. Junto revokes the stored credential and the agent can no longer reach your mailbox. Your list of other mailboxes is kept and reappears when you connect again; Exchange still checks your access on every read.
• Remove an added mailbox -- Click the remove icon on its row under Other mailboxes.
• When someone leaves -- Removing a member from the organization, changing their role to Customer, or deleting their account deactivates their personal connections, revokes the stored credentials, and clears their list of other mailboxes. If a sign-in was still in progress when they were removed, it is refused. A member who is re-added later must connect again. Administrators can see who has a connection on the Personal connections card under Settings > General before offboarding.

You can also revoke Junto's access from your Microsoft account at any time. The next time the agent tries to use the connection, Junto reports that it needs to be reconnected.

Troubleshooting

• "Your Outlook mailbox isn't connected" -- You have not connected Outlook, or you disconnected it. Open your avatar menu, choose My connections, and click Connect on the Outlook card.
• "Your Outlook connection needs to be reconnected" -- Your Microsoft sign-in expired or was revoked. Click Reconnect on the My connections page. Retrying the request will not help until you do.
• The agent says the tool only runs in your own Explore chat or MCP client -- You asked from a place that cannot use personal connections: a Slack or Teams message, a runbook, an automation, a workspace, or code mode. Ask again from Explore in the Junto web app or from your MCP client.
• Microsoft asks for administrator approval during sign-in -- Your tenant requires admin consent for new applications. Ask a Microsoft 365 administrator to approve the permissions Junto requests, then connect again.
• The card stays on "Finishing..." -- Junto waits briefly for Microsoft to confirm the connection. Refresh the page after a few seconds; if the card still shows Not connected, try Connect again.
• "Reconnect Outlook to allow shared mailboxes, then add it again" -- Your connection was made before support for other mailboxes was added, so it lacks the permission to read mail in mailboxes you have access to. Click Reconnect, accept the permissions, then add the mailbox.
• "You don't have access to this mailbox in Exchange" -- Your account does not hold Full Access to that mailbox, or the permission has not finished propagating. Ask your Microsoft 365 administrator to grant Full Access, wait a few minutes, then try Add mailbox again.
• "Outlook refused to read" a mailbox you added earlier -- Your Full Access to it was removed in Exchange, or your connection is missing the shared-mailbox permission. Have the permission restored, or reconnect Outlook under My connections.
• "Couldn't reach Outlook to check that mailbox" -- A temporary problem reaching Microsoft. Try again in a moment.
• "Your Outlook connection changed after you approved this. Nothing was sent." -- You reconnected Outlook between approving a send and the agent sending it. Ask again and review the message against the mailbox that is connected now.
• "Outlook did not confirm this send" -- Microsoft did not answer in time, so the email may or may not have gone out. Check your Sent Items in Outlook before asking the agent to send again, so the recipient does not receive it twice.
• "Your role can no longer add mailboxes" -- Your role was changed to Customer, which cannot own personal connections. Ask an administrator about your role.