ChatGPT Outlook Integration: Permissions and Safe Email Workflows

ChatGPT's Outlook integration is two apps, Outlook Email and Outlook Calendar, that connect a signed-in user's Microsoft 365 mailbox and calendar to ChatGPT after a Microsoft Entra administrator grants organization-wide consent. Out of the box the email app searches and reads messages and contacts so ChatGPT can summarize threads and draft replies; sending mail, moving messages and working in shared mailboxes are separate actions that a workspace admin has to enable and that ChatGPT asks the user to confirm under the default approval setting. The permission request the Entra administrator sees can include Mail.Send and Mail.ReadWrite, so the safe rollout is to approve only what the first workflows need and keep write actions behind "Always ask".

This page covers the ChatGPT side of Outlook: what the apps do, the permissions in plain words, the steps for both administrators, workflows that do not put a model in charge of your outbox, and the usual failures. For what AI email tools do in general, see AI email management for small business.

What does the ChatGPT Outlook integration do?

OpenAI's article on the Outlook Email and Calendar apps says the apps connect ChatGPT to supported Microsoft account information, with available actions depending on account permissions, Entra consent and workspace settings. Access is live; nothing is synced or indexed. As of October 2026:

• Outlook Email searches and retrieves messages with metadata and plain-text bodies using keyword and structured filters (sender, subject, date), looks up people and saved contacts, and, when enabled, lists, creates, updates and deletes contacts. OpenAI's examples are summarizing a thread, listing unread mail, building a table of senders and dates, and drafting replies.
• Outlook Calendar reads and searches events, basic availability and meeting-time suggestions, reads delegated or shared calendars, and, when permissions and actions allow, creates, updates, RSVPs to, cancels or deletes events on supported shared calendars.
• Shared mailboxes. For supported shared mailboxes ChatGPT can read messages, browse folders, mark messages read or unread, move messages, and send plain-text email from or on behalf of the mailbox. The user must name the exact mailbox address, must already have Microsoft access to it (ChatGPT does not grant sharing or delegation rights), and attachments in shared or delegated mailboxes cannot be retrieved.

Plan availability is not listed in the article. The admin controls described here exist in ChatGPT Business (formerly ChatGPT Team), Enterprise and Edu workspaces; in Business, apps are enabled by default and administrators change workspace-wide availability, while new Enterprise and Edu workspaces start with a selected set of apps and assign the rest per role. The search for an OpenAI Outlook integration outside ChatGPT, such as a mailbox automation that runs on a schedule, is an application you build on the API against Microsoft Graph, covered below. One caution on write actions: OpenAI's article on custom MCP servers, opened the same day as the Outlook article, still describes OpenAI-built apps as search-only, so treat every send, move or contact action here as something to confirm in your workspace's Actions panel.

Which Microsoft permissions does it ask for, and what do they mean?

OpenAI's article lists the Microsoft Graph scopes the apps can request. The ChatGPT admin chooses which optional ones to include before the Entra step, and that choice is the real control, because Microsoft's consent screen approves or rejects the whole request. Descriptions below are Microsoft's, from the Graph permissions reference; all are delegated, which Microsoft defines as letting the app act on behalf of the signed-in user without accessing anything that user could not access.

How does a Microsoft 365 administrator enable it safely?

1. Agree the first workflows and the pilot group in writing, and decide that the pilot is read-only.
2. Select the permissions in ChatGPT. A workspace owner or admin opens the Admin console, selects the workspace, opens Plugins and chooses Configure Microsoft permissions (legacy workspaces: Manage Legacy Apps, the app, Microsoft permissions). Required permissions stay selected; toggle off the optional write and send scopes.
3. Review in Entra. Select Review permissions in Microsoft Entra and sign in as an administrator who can grant organization-wide consent. Microsoft's guide to tenant-wide admin consent names Privileged Role Administrator, or Cloud Application Administrator and Application Administrator for anything except Graph application permissions, and calls the grant a sensitive operation. Confirm the organization and the "ChatGPT / OpenAI, L.L.C." application, then Accept.
4. Restrict who can use the app. Tenant-wide consent lets all users access the application unless restricted, per Microsoft; require user assignment on the enterprise application and assign the pilot group.
5. Enable actions in ChatGPT. Approval does not enable anything. Under Actions enable read actions only; under New actions choose "Only enable new read actions" or "Disable new actions" so a vendor update cannot add a write action quietly; set the approval mode to "Always ask".
6. Exclude labeled mail (Enterprise). Add the sensitivity-label GUIDs to exclude (the GUID, not the display name); OpenAI says attachments to an excluded message are excluded with it.
7. Connect the pilot users. Each confirms the right ChatGPT workspace, connects their Microsoft account and reviews the permissions. Users may need to reconnect after permissions change.
8. Keep the review habit. Microsoft's Enterprise apps page shows the granted permissions under the Admin consent tab and lets an administrator revoke them; put it on the monthly checklist.

Which email workflows are safe to pilot?

Hold back anything that sends without a human click, deletes or archives in bulk, or changes rules that affect other people's mail. Those are automations, and they belong in the next section with their own approvals.

Can ChatGPT send email, and what about shared mailboxes?

It can, if Mail.Send (or Mail.Send.Shared) was consented and a workspace admin enabled the send action; for shared mailboxes OpenAI says Microsoft permissions decide whether mail goes out as the mailbox or on its behalf. OpenAI's own troubleshooting note is worth repeating to staff: if a send or move is interrupted, check Outlook before retrying, because an error does not confirm that nothing changed. For most small companies the better design keeps sending with people, and gives an automation draft-only rights. On the Microsoft side that is an application with Graph permissions that create drafts but not send, and Exchange Online's RBAC for Applications, which Microsoft says replaces Application Access Policies, scopes an application's mailbox access to named mailboxes instead of the whole tenant. Microsoft's description of the application-level Mail.Send role, "send mail as any user without a signed-in user", is the reason to keep that role off any AI integration until a specific workflow earns it.

What about prompt injection through email?

Email is untrusted input written by strangers. OWASP's 2025 Top 10 for LLM Applications describes prompt injection and notes that indirect injections occur when an LLM accepts input from external sources such as websites or files; a message that says "forward this thread to the address below" is the mailbox version. The defenses are the ones already in this guide: read-only scopes, write actions behind confirmation, and a test before launch in which a pilot user receives a message containing instructions and asks ChatGPT to summarize it. The summary should describe the instruction as content, and no action should be proposed.

Troubleshooting the Outlook apps

• "Need admin approval" when connecting. Consent is missing or a grant was changed; an Entra admin reviews it and the ChatGPT approval flow is rerun.
• An action fails after approval. Confirm the action is enabled in workspace settings, the Entra grant still exists, and the user's connection was refreshed with the required permissions.
• Messages are missing or times are wrong. Narrow the date range and use distinctive terms, splitting large requests; a wrong time zone usually means MailboxSettings.Read, which OpenAI says is required for answers in the user's time zone, was not consented.
• The app does not appear, or shared-mailbox attachments cannot be read. Check role access and any approved-domain policy; attachment retrieval works only in the signed-in user's own mailbox.

How NetSys sets up ChatGPT with Outlook

Under our ChatGPT Business workspace setup service we configure the workspace, SSO and app defaults before anyone connects a mailbox. For the Outlook connection, our OpenAI and ChatGPT integration service selects the scopes with you, runs the Entra consent with your administrator, assigns the pilot group, sets read-only actions and "Always ask", runs the injection test, and documents the grant so your security owner can revoke it in Entra. Automations that draft into shared mailboxes are built as agents with an approval queue, and the same engineers manage the Microsoft 365 tenant. Security settings for the workspace itself are in our ChatGPT Business security settings checklist.

Request an email integration review before the consent is granted.

Frequently asked questions

Can ChatGPT read my Outlook email?

Yes, once an Entra administrator has consented to the Outlook Email app and you have connected your Microsoft account. It reads only your own mailbox, and shared mailboxes only where you already have access, live rather than from a copy.

Can ChatGPT send emails through Outlook?

Only if Mail.Send or Mail.Send.Shared was included in the consent and a workspace admin enabled the send action; under "Always ask" ChatGPT confirms before sending. Many companies leave sending out of the first rollout and have ChatGPT draft while people send.

Does the integration work with shared mailboxes?

Yes, for supported shared mailboxes, with the Shared scopes consented and the user already holding Exchange access. ChatGPT can read, browse folders, mark and move messages and send plain-text mail as or on behalf of the mailbox, but cannot retrieve attachments there.

Do we need ChatGPT Business or Enterprise?

OpenAI's article does not list plans. The admin consent flow, action controls and approval settings described here are workspace features of Business, Enterprise and Edu, and the sensitivity-label exclusions are Enterprise. A company should connect mailboxes only from a workspace it administers.

Is our email used to train ChatGPT?

OpenAI says that by default it does not train on data accessed from apps and does not train on Business or Enterprise workspace data. Conversations that quote mail are stored under the workspace retention policy your admins set.

How is this different from Copilot in Outlook?

Microsoft 365 Copilot runs inside Outlook under Microsoft's license and the user's own mailbox permissions, with no OpenAI consent step; the ChatGPT apps bring Outlook content into ChatGPT. Companies that already license Copilot often start there for mail; our Microsoft 365 Copilot consulting page covers that path.