Overview
DeepMask exposes a set of read-only Outlook actions that let users read mail, browse calendars, look up contacts, and get intelligent summaries of their inbox — all scoped to what the signed-in user already has access to in your Microsoft 365 tenant. Actions are grouped into four categories:All Outlook actions are read-only. DeepMask cannot send, delete, or modify mail, events, or contacts. Every action runs on behalf of the signed-in user — they can only access content they already have permission to see.
Calendar
Contacts
Compound
Prerequisites
Before using Outlook actions in DeepMask, confirm the following are in place.Required Access
- Microsoft 365 account (Business Basic or higher) — Your organization must have an active Microsoft 365 or Office 365 subscription with Exchange Online and Outlook enabled.
- User signed in via Microsoft — Each user must sign in with their own Microsoft account through DeepMask’s connector. Actions run under that user’s identity and are limited to content they already have access to.
What You Do Not Need
- No developer tools, code, or command-line experience
- No changes to existing mailbox permissions
- No service account or shared credentials
DeepMask uses OAuth 2.0 delegated authentication. When a user connects their account, they sign in with their own Microsoft credentials. DeepMask never stores passwords or receives broader access than the user already has in your tenant.
Common Parameters
Several parameters appear across multiple actions.Well-Known Folder IDs
Mail actions accept either a folder ID fromoutlook_list_folders or these well-known names:
Typical Workflows
Reading recent emails
1
List folders
Call
outlook_list_folders to see all available mail folders and their IDs.2
List messages
Call
outlook_list_messages with a folder_id (e.g. "inbox") to get messages newest-first.3
Read a message
Call
outlook_get_message with a message_id from the list to get the full body.4
Check attachments
Call
outlook_list_attachments with the message_id, then outlook_get_attachment with an attachment_id to download a file.Getting a daily briefing
1
Catch up on the inbox
Call
outlook_catch_me_up with hours_back set to how far back to scan (default 24h) and include_calendar=true to also surface upcoming events.2
Drill into priority items
Use the
message_id values returned in flagged to call outlook_get_message for full context on the most urgent threads.Finding a specific email thread
1
Search messages
Call
outlook_search_messages with a KQL query — e.g. "from:alice@example.com subject:budget".2
Read the full message
Pass a
message_id from the results to outlook_get_message.Checking the calendar
1
List events for a date range
Call
outlook_list_events with start_datetime and end_datetime in ISO 8601 UTC format — e.g. "2024-06-01T00:00:00Z".2
Get event details
Call
outlook_get_event with an event_id to see the full attendee list, body, and recurrence info.Pagination
Actions that return lists support pagination vialimit and offset.
outlook_search_contacts does not support offset paging. Results are unordered and a single page is returned up to the limit.Security & Privacy
DeepMask is designed so that you retain full control of your data and your users’ access. This section explains the key security properties of the Outlook integration.Delegated Authentication
DeepMask uses OAuth 2.0 delegated permissions, not application-level (app-only) permissions. This means:- Every action performed by DeepMask is done on behalf of the signed-in user.
- A user can only read mail, calendar events, and contacts they already have access to.
- DeepMask cannot bypass Exchange Online’s existing access controls.
- Removing a user’s mailbox access in Microsoft 365 immediately removes their access in DeepMask.
No Stored Credentials
DeepMask does not store your Microsoft password, your Client Secret, or raw mailbox content. Authentication is handled entirely through short-lived OAuth access tokens and refresh tokens, which are encrypted at rest.No Service Account
Unlike some integrations that use a single shared service account to access all data, DeepMask authenticates each user individually. This ensures audit logs in your Microsoft 365 tenant accurately reflect which user accessed which content.Read-Only Permissions
All active Outlook actions are strictly read-only. DeepMask requests no write, send, or delete permissions — it cannot send mail, create events, or modify contacts. The delegated Microsoft Graph permissions used by these actions are:If a user reports missing mail or calendar events, confirm that admin consent has been granted for all required permissions in your Azure AD app registration. See the Enterprise Integration Setup guide for details.
Revoking Access
To disconnect DeepMask from Outlook at any time:- In DeepMask → Connectors → Microsoft (Enterprise), click Disconnect.
Questions about data residency, compliance, or security? Contact DeepMask support at support@deepmask.io.