> This page is for Tools.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.moveworks.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.moveworks.com/_mcp/server.

# Outlook (Live Search) Setup for Enterprise Search

> **Info**
>
> This page is for the **Outlook (Next Gen)** connector and it can only be configured within the new enterprise search configuration experience explained below.
>
> Please visit [this documentation](/tool-studio/enterprise-search/content-integrations) to learn more about Max Capacity and Classic connectors.

# System Overview

Microsoft Outlook (as part of Microsoft 365) is your organization's primary hub for email communication and calendar management. From an enterprise search perspective, Outlook is a critical system for knowledge available in emails, attachments, and meeting details. Moveworks connects to Outlook via Microsoft Graph APIs to perform **live search** across email content, returning results that based on user permissions, without storing or indexing any mailbox data.

### Authentication

Authentication is accomplished by creating and registering an [Azure App Registration](https://docs.microsoft.com/en-us/graph/auth-v2-service) for the following approach for live search:

* Uses delegated OAuth with a separate Azure App Registration and client secret
* End users sign in and provide consent for the first time; Moveworks then searches only the emails they can access in Outlook
* No enterprise-wide indexing of Outlook content occurs

### Permissions Enforcement

**Live Search:** Results are retrieved on behalf of the signed-in user using their delegated token, so source-system permissions are inherently enforced.

### API Usage

Moveworks uses the standard Graph API v1.0 to perform live search from Outlook. We use only delegated permissions with admin-granted access for live search.

### Content Types

**Live Search**

* **On-demand results** from the signed-in user’s accessible Outlook emails
* **Not indexed** into the enterprise corpus; fetched at query time after user consent
* **Note:** Currently, calendar events are not supported in live search

> **User identity and permissions**
>
> Max Capacity always auto-generates this system's permission configuration. It also auto-generates the **user identity** configuration, but only when your organization already has an identity configuration and its joining key resolves to an email address (the joining key is the email itself, or a non-email key such as an employee ID is mapped to the email field of your primary identity source). If either condition is not met, only the user identity configuration is skipped — your Max Capacity setup is not blocked. User identity is a separate, independent configuration you can complete before or after connecting this system. See [Configure User Identity](/platform-management/user-identity/mw-setup-identity).

---

# Access Requirements

## Pre-requisites

Before you get started, make sure you have everything you need:

* **Admin roles**
  * **Global Admin** permissions to create App registrations and grant admin consent
* **Environment details**
  * Cloud environment: Commercial or GOV L4

## Understanding Permissions Scopes required for Enterprise Search

Outlook Live Search uses **delegated, read-only** Microsoft Graph permissions. Every request runs on behalf of the signed-in user, so search results are always limited to content that user can already access in Outlook. Moveworks requests no write permissions and does not index or store any mailbox or calendar content.

The following scopes are requested when a user first signs in and grants consent:

| Scope                   | Type                        | Why it is required                                                                                                                                                                                                                                                                                |
| ----------------------- | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `User.Read`             | Microsoft Graph (delegated) | Signs the user in and reads their basic profile.                                                                                                                                                                                                                                                  |
| `Mail.Read`             | Microsoft Graph (delegated) | Reads the signed-in user's own email messages.                                                                                                                                                                                                                                                    |
| `Mail.Read.Shared`      | Microsoft Graph (delegated) | Reads shared and delegated mailboxes the user already has access to — for example a shared team inbox (such as `support@`) or a mailbox that has been delegated to the user. Access stays bounded by the user's existing Exchange permissions; it does not grant access to any other user's mail. |
| `Calendars.Read`        | Microsoft Graph (delegated) | Reads the signed-in user's own calendar events.                                                                                                                                                                                                                                                   |
| `Calendars.Read.Shared` | Microsoft Graph (delegated) | Reads shared and delegated calendars the user already has access to. Access stays bounded by the user's existing Exchange permissions.                                                                                                                                                            |
| `offline_access`        | OpenID Connect (standard)   | Lets Moveworks refresh the user's access token so search keeps working without prompting the user to sign in repeatedly. This scope grants **no access to any data** — it only issues a refresh token.                                                                                            |

> **Info**
>
> When adding permissions in the Azure portal (Step 3 below), add all five Microsoft Graph **delegated** permissions: `User.Read`, `Mail.Read`, `Mail.Read.Shared`, `Calendars.Read`, and `Calendars.Read.Shared`. `offline_access` is a standard OpenID Connect scope — it does not need to be added as an API permission and is requested automatically at sign-in, but it will appear on the consent screen.

## Instructions for Outlook Live Search

### 1. Register a new App

1. Sign in to the [Azure portal](https://portal.azure.com/)
2. Select **Microsoft Entra ID** > **Manage** > **App registrations** > **New registration**
3. On the Register an application page, register an app with the following details

   <table>
     <thead>
       <tr>
         <th>
           Field
         </th>

         <th>
           Value
         </th>
       </tr>
     </thead>

     <tbody>
       <tr>
         <td>
           Name
         </td>

         <td>
           `Moveworks`
         </td>
       </tr>

       <tr>
         <td>
           Supported account types
         </td>

         <td>
           Accounts in this organizational directory only (Single tenant)
         </td>
       </tr>

       <tr>
         <td>
           Redirect URI
         </td>

         <td>
           Platform: Web

           URI value:`https://<your_org>.moveworks.com/auth/oauthCallback`
         </td>
       </tr>
     </tbody>
   </table>

   ![](https://files.readme.io/516e2369f885dfe688e8007194a9db870aac6c538237d02fc3764bf96b0495b1-image.png)
4. From the overview page, note down the following values:
   1. Directory (tenant) ID
   2. Application (client) ID

### 2. Add Client Credentials

1. From the overview page, click on **Add a certificate or secret** link (Alternatively, Go to **Manage** > **Certificates and Secrets** in the left sidebar)

   ![](https://files.readme.io/025afb7f9991dc637c73f08806b90e9ff39bc9732981f065a5ea5eb96ff51d52-image.png)
2. Click on **New client secret** button

   ![](https://files.readme.io/e690530b209b854fb3a80a936d08a02d85def3929de98ab8d4fcfbfed40aca98-image.png)
3. Add a **description** and select your desired **expiry period** for the secret, and Click on **Add** button

   ![](https://files.readme.io/dfc25b64098026dedb9350734287a0585d5e4464d28e998326944889d14f435f-image.png)
4. Click on **Copy** button and **Save** the value of secret, as it's shown only once

   ![](https://files.readme.io/4cabcbcb1bf026d81662e0143e27cb448bb30faee7020df02a4329b113e2686d-SCR-20251124-qohn.png)

### 3. Add Application API permissions & grant admin consent

1. Open the App Registration you created above and click on **Manage > API Permissions**
2. Click **Add a permission**
3. This will open a panel on the right side:

   ![](https://files.readme.io/34942ebc7927b70223cf5158492961b7f85d0950da2d006e46381d3f6257835a-image.png)
4. Select **Microsoft Graph**
5. Choose **Delegated permissions**

   ![](https://files.readme.io/60965e5b6afc8d43f4efa76cafe60e429f331a2407360d187ea4a37b1d0ad70c-image.png)
6. A search bar will appear

   ![](https://files.readme.io/e200d3b09b79593d6bf76cc5a8dd549ed79366822f9bf5e67a6712b3cf69770d-image.png)

   \

7. Search for the permissions you need to grant (noted above) and check the box for each

   ![](https://files.readme.io/849f03e89714def7b05d30e774118cd7f09b5ec714f7bec5d4dd0ef6c58692e7-image.png)

   ![](https://files.readme.io/d80ff7a4327321835ee28fd36a49b3422f180af37005ca43bf23f763e0b0d6cb-image.png)
8. Once they’ve all been checked, click **Add permissions**

   ![](https://files.readme.io/33ed19180ddc95cddda8ec0ec32733e951038ff5d85c4a8c1fb5d55775756ee4-image.png)
9. You’ll now see all the newly added permissions will have a status of **“Not granted for”** your organization
10. To complete the process, click **Grant admin consent** for your organization

    ![](https://files.readme.io/148665f2b9db21e312e2d0d522ed9742efaefcdfcf8e257b3490594cd0828c5e-image.png)
11. If this panel appears, click **Yes, add other granted permissions to configured permissions** then **Save and continue**, then **Grant admin consent**, and then **Yes**

    ![](https://files.readme.io/ab65b8ba63c42e6f4ac1daedd7ff9a61faacead04328cea9394de9730c638a3e-image.png)

    ![](https://files.readme.io/22650d6471f942b3187fe11877e8931be145da4e033cfec511a0f64812dad6b9-image.png)
12. You will see **green** checkmarks on the newly added permissions if this was successful

---

# Setup in Moveworks

1. Log in to your org's **MyMoveworks** portal
2. Navigate to **Moveworks Setup** > **Connectors** > **Built-in Connectors**

   ![](https://files.readme.io/6bc7facdbcac660f7fdf86b7efd352b61018b9188c428f6b65cee7eb7cde58a4-image.png)
3. Click **Create New**

   ![](https://files.readme.io/629ed23b1ed40429f111c37e1031607113d74c6d71a2c9331cf099ef82f884e5-image.png)
4. Search and Select **Outlook (Next Gen)**

   ![](https://files.readme.io/413f48324d687e75c0031297dc39358425258c64c1740ed6ffcc91541e321823-image.png)
5. Click on Next: **Add Creds**

   ![](https://files.readme.io/73d3320398e56b2ec4189a04b7c0a7dcf32d3f0e827e420068b0e9ee984b0dad-image.png)
6. Input the following details (copied from steps above)
   1. **Connector Name:** Name this connector for your future reference. Once set, this name cannot be changed
   2. **Application (Client) ID:** The unique identifier for your Azure app registration
   3. **Application Client Secret:** The secret key for your Azure app to authenticate with Microsoft Graph APIs
   4. **Tenant (directory) ID:** Your organization's unique Azure Active Directory identifier
   5. **Region (optional):** Select an option that will be used to establish the base URL. If no selection is made, the default option will be commercial. If GOV L4 is selected .us token url will be created
   6. Click **Save**. This connector will now be used to configure live search from Outlook. Refer to the steps mentioned below

      ![](https://files.readme.io/68ec10c3a2391637dd3a76a31580c870d52154a2b3e583c4926773cef1fd1ca0-image.png)

---

# Configuring Outlook for Enterprise Search

### Initialising setup

1. Log in to your org's **MyMoveworks** portal
2. Navigate to **Moveworks Setup** > **Search** > **Configure Search** > **Max Capacity**

   ![](https://files.readme.io/041fb993a7a5a91156e0ade58a02021c1ef460dcff0a53de358cce6c718f24b6-image.png)
3. Click on **Create New** or **Get Started**

   ![](https://files.readme.io/5de85bf100244cf4fd801cbb563aaa77d243224d8a3f54a7b24e46a9c2e6e9cd-image.png)
4. Select **Outlook** from the dropdown list and click on the **Get Started** button

   ![](https://files.readme.io/896db49de800a9fad13bf422b31fac6f4bcd3f0974c5f6fae355305782372876-image.png)
5. System Overview: This presents an overview of Outlook support from Moveworks
   1. **Ingestion Summary:** Not applicable for Live Search systems
   2. **Connector Selection:** In this configuration block, you are required to select the required connector to enable Moveworks to connect and fetch data or enable live search
   3. **Content Selection:** In this configuration block, you are required to define the content that should be ingested within Moveworks

      ![](https://files.readme.io/63c20de0159291302cd6d1050734b9dd81989b320a2a81e996add655dcde8fdb-image.png)

      \


### Connector Selection and Validation

1. Once you click on Select Connector, a connector setup screen will appear as follows
2. Select the connector (from the dropdown) that you have created in the Connector Creation step
   > **Info**
   >
   > **Please note:** Only the Outlook connectors will appear in this list.
3. Once the connector is selected, you need to click on Start Validation to validate the connector credentials and required scope

   > **Info**
   >
   > **Connector Validation**
   >
   > This is a mandatory step in order to save the configuration and move to the next step.
   >
   > Moveworks validates the selected connector to check:
   >
   > * Content: Moveworks validates whether connector has right scopes to fetch content
4. If the connector is validated successfully, you will see a green info banner as follows
5. If there are any credentials or scope issues, you will receive an error message as follows. Click on View Details to identify the issue.
6. Once the connector is validated successfully, you will be able to **Save** the configuration
7. Input the unique configuration name and **Save**
8. Once the configuration is saved, you can view the unique configuration name at the top of the screen. You can also click the pencil 🖊️ icon to edit the configuration name
9. Additionally, you will see a banner at the top of the screen with an Enable Live Search button. Click it to activate the **Outlook** Live Search feature for your Enterprise Search web application
10. Additionally, you will start seeing an entry of your configuration in the Enterprise Search home page. You can click on your configuration to go to edit/ complete the configuration

### Audience configuration

Live Search does not serve results until you set the audience. From the configuration's home page, open the **Target audience** tab and choose who can search — source permissions are always enforced on top of your selection.

Audience configuration is the same for every Max Capacity connector. For the full steps and options, see [Step 4: Define Target Audience](/tool-studio/enterprise-search/configure-enterprise-search/box-setup-for-enterprise-search#audience-configuration) in the Max Capacity Setup overview.