Outlook MCP Servers — Microsoft's Enterprise Email Meets the Agent Era

If Gmail MCP servers deal with personal inboxes, Outlook MCP servers deal with corporate ones. Microsoft 365 mail sits behind Entra ID, compliance policies, Data Loss Prevention rules, and IT admin controls. That’s the whole point — and it’s what makes the MCP integration story more complicated than Gmail’s.

The good news: Microsoft shipped official MCP servers for Outlook Mail and Calendar as part of their Work IQ platform. The bad news: they require a Microsoft 365 Copilot license (~$30/user/month) and are still in preview — and as of April 15, 2026, Microsoft pulled back Copilot Chat access from Word, Excel, PowerPoint, and OneNote for large-enterprise users without the full Copilot license, making the paywall even more relevant (Computerworld; Washington State University ITS). Then on April 27, Outlook.com suffered a same-day outage that caused sign-in failures, which Microsoft attributed to “a recently introduced change” it reverted via a configuration rollback — a reminder of how fragile the auth infrastructure that every MCP server depends on can be. Community servers fill the gap for everyone else — and Softeria’s ms-365-mcp-server has kept shipping rapidly, now at v0.146.1 with 933 stars (up from v0.91.0 and 665 stars in April, when it added webhooks, sensitivity labels, and mail delta sync in a single week). Part of our Communication & Collaboration MCP category.

The Landscape

*Stars for the entire microsoft/mcp catalog, not the Mail server alone. (Star counts and other stats in this review verified 2026-08-26; a previously-listed server, Abhishek-Aditya-bs/Outlook-MCP-Server, has been removed from this table because its GitHub repository now returns 404 — the code is no longer publicly accessible and its stats can’t be verified.)

Every server in this table uses Microsoft Graph API, which means every one requires Azure AD / Entra ID credentials. No shortcuts, no API keys, no personal access tokens. This is a feature for enterprise security teams and a hurdle for individual developers. (One Windows-only server covered later in this piece — under “Also in the Landscape” — uses local Outlook COM automation instead of Graph API.)

Microsoft Work IQ Mail — The Official Server

Microsoft’s own Mail MCP server is part of the broader Work IQ platform (976 stars) and the microsoft/mcp catalog (3,602 stars across all Microsoft MCP servers). It ships alongside Work IQ servers for Calendar, Teams, Copilot Chat, SharePoint, and more. On March 9, 2026, Microsoft launched MCP Apps in Copilot chat — agents can now bring rich HTML-based UI experiences directly into Microsoft 365 Copilot chat, grounded in Work IQ organizational context. A new workiq-productivity plugin adds read-only email triage and meeting-cost-analysis skills.

10 tools (per Microsoft’s Mail tools reference):

Transport: Hosted remote server. No local process needed — your MCP client connects directly to Microsoft’s infrastructure.

Auth: OAuth via Microsoft Entra ID. Operations respect existing Graph permissions, user privileges, and tenant security policies.

Status: Preview. Microsoft’s docs explicitly state: “Preview features have restricted functionality and aren’t meant for production use.”

What works well

KQL search is the standout. The searchMessages tool uses Microsoft Graph Search API with Keyword Query Language. You can search across subject, body, and attachments with the same query syntax Outlook users already know. This is something Gmail’s community servers also offer, but having it in an official server with first-party indexing is a step up.

Full email lifecycle. Create drafts, update them, send them, reply, reply-all, delete — the 10 tools cover the complete email workflow. The draft-then-send pattern (createMessage → sendDraft) is useful for agents that should compose but not send without confirmation.

Hosted architecture. Like the Work IQ Teams server, Microsoft hosts this. No npm packages to install, no Docker containers, no local token files. This eliminates deployment friction and means Microsoft handles updates.

ETag concurrency control. The updateMessage and deleteMessage tools support If-Match headers for optimistic concurrency. This prevents race conditions when multiple agents or users modify the same message — an enterprise-grade detail that community servers typically skip.

What doesn’t

Copilot license required — and the paywall is tightening. You need a Microsoft 365 Copilot license to use Work IQ MCP servers. At ~$30/user/month, this immediately prices out individual developers, small teams, and anyone who just wants Outlook MCP access without the full Copilot suite. As of April 15, 2026, Microsoft pulled back Copilot Chat access from M365 apps (Word, Excel, PowerPoint, OneNote) for large-enterprise users without the full Copilot license (Computerworld; WSU ITS) — reinforcing the premium boundary rather than relaxing it. The community servers exist largely because of this paywall.

Preview means preview. Just like the Teams server, Microsoft warns this may be “substantially modified before release.” Building production email workflows on preview APIs is risky.

No folder management. You can’t list folders, create folders, or move messages between folders. For users who rely on folder-based email organization, this is a gap.

No attachment handling. The tools can send emails and search attachments, but there’s no dedicated tool for downloading or uploading attachments. This limits agent use cases around file extraction from emails.

No contact integration. Reading or managing Outlook contacts requires a separate server. The Mail server is strictly mail.

Softeria/ms-365-mcp-server — The Community Standard

ms-365-mcp-server (933 stars; MIT license) is the most popular community Outlook MCP server by a wide margin — and the pace hasn’t slowed. In a single week in late April 2026 (April 22–30), Softeria shipped 7 releases (v0.85.2 → v0.91.0), adding webhook subscriptions, MIP sensitivity labels, Excel range writes, OneDrive sharing links, and mail copy/categories/delta sync. The project has kept releasing at a steady clip since: as of late August 2026 it’s at v0.146.1, with 292 total releases on GitHub, expanding from a solid M365 wrapper into a comprehensive 300+ tool platform covering virtually the entire Microsoft Graph API surface. PulseMCP tracks roughly 23K weekly visitors to its listing for the server.

Supported services:

• Email — list, send, delete, create drafts, reply, reply-all, move messages, copy, categories, delta sync (new in v0.91.0)
• Calendar — manage events, delta sync, calendar event actions, group calendars (new in v0.86.0)
• OneDrive — file upload/download, folder operations, search, sharing links/copy/preview (new in v0.90.0)
• Excel — worksheet and range operations, range writes (new in v0.88.0)
• OneNote — notebook and page management, site-scoped notebooks
• Tasks — To Do and Planner task management
• Contacts — Outlook contact operations
• User Profile & Search — directory and user queries
• Groups — create/update/delete, member/owner management (new in v0.84.0)
• Places — rooms, room lists (new in v0.77.0)
• Virtual Events — webinar endpoints (new in v0.73.0)
• Trending Insights — trending documents (new in v0.81.0)
• Webhooks — change notification subscriptions (new in v0.87.0)
• MIP Sensitivity Labels — file and tenant label management (new in v0.89.0)

With --org-mode flag (organizational accounts):

• Teams & Chats (including create-chat in v0.85.0), SharePoint (including OneNote, new in v0.86.0), Online Meetings (transcripts/recordings), Shared Mailboxes, User Management, Planner buckets (new in v0.86.0)

Install: npx @softeria/ms-365-mcp-server

Auth: Three modes — Device Code Flow (interactive, with token caching), OAuth Authorization Code (for HTTP transport, now with OAuth 2.1 and dynamic client registration), or Bring Your Own Token (for CI/CD or automated systems).

What works well

Breadth that no single Microsoft server matches. One NPX command gives you email, calendar, files, tasks, contacts, Excel, OneNote, groups, places, virtual events, and more. Microsoft’s approach splits these across separate Work IQ servers, each requiring its own setup. Softeria unifies them — now with 300+ tools.

TOON output format. The experimental “Token-Oriented Object Notation,” documented in the project’s README, claims 30-60% fewer tokens than standard JSON. For LLM integrations where every token costs money, this is a meaningful optimization that no other Outlook MCP server offers.

Dynamic tool discovery. With 300+ tools, loading them all wastes context. Softeria’s README describes dynamic discovery so the LLM finds and loads only the tools it needs, plus preset categories (mail, calendar, files, personal, work, excel, contacts, tasks, onenote, search, users, outlook, onedrive, teams, all) that scope the tool surface per client. This elegantly solves the context bloat problem that tool sprawl creates.

Multi-account support. A single server instance can manage multiple Microsoft 365 accounts simultaneously. Switch between personal and work accounts without reconfiguring.

Read-only mode. Start with --read-only to restrict all operations to safe reads. Useful for testing or building agents that should never modify data. Tool filtering adds another layer — you can expose only specific tools to specific agents.

Webhook subscriptions (v0.87.0). Change notification support lets agents react to mailbox events in real time rather than polling. Combined with mail delta sync (v0.91.0), agents can now maintain an efficient, event-driven view of a user’s inbox — a capability that was previously only available through direct Graph API integration.

Security hardening (April 2026). PKCE store size bounded to prevent memory exhaustion, default CORS restricted from wildcard to localhost, log directory moved to user home with secure permissions, pagination memory limits, and startup validation for --enabled-tools regex. This is the kind of production-grade security work most community servers skip.

No Copilot license required. Uses standard Microsoft Graph API permissions. Any Microsoft 365 account (including free personal accounts for some features) can authenticate.

What doesn’t

The April 2026 bug backlog got cleared, but new ones keep landing. The two feature-request issues noted in this review’s prior audit (a configurable Teams-message signoff and a teams-write preset) have since shipped and closed. But as of August 26, 2026 the issue tracker shows 2 fresh open issues, both filed August 24: a device-code login bug where the refresh-token cache doesn’t persist the newly issued token and keeps replaying the stale original until it hits Entra’s re-auth limit, and an MCP spec-conformance report flagging that the server’s server/discover handling breaks against the newest 2026-07-28 spec revision. The specific bugs an earlier audit of this page flagged in April (broken create-todo-task exposure, a file-upload rejection, create-draft-email failing in OAuth mode, an OAuth callback port issue, and a different refresh-token bug) were fixed months ago — but a new refresh-token issue has just replaced the old one. That churn is itself the risk: 7 releases in a single week in April, and 292 releases total by late August, means the API surface moves fast enough that today’s issue count is a snapshot, not a guarantee — and this snapshot shows an active auth bug, not a clean tracker.

Rapid release pace creates integration risk. If you pin a version, you miss security fixes; if you don’t, you may get breaking changes. Enterprise teams that need stability may find this cadence uncomfortable.

Node.js 20+ recommended. Works with Node.js 14+ but with dependency warnings. The recommended version is higher than what many systems run.

ryaker/outlook-mcp — Outlook + OneDrive + Power Automate

outlook-mcp (432 stars) connects Outlook with OneDrive and Power Automate — a combination few other servers offer. Recent work includes HTML email sanitization to prevent prompt injection attacks (merged) — a security concern that’s increasingly relevant as agents interact with untrusted email content.

Covers three services:

• Outlook — email list/search/send/read, calendar events, folder management, mail rules
• OneDrive — file upload/download, search, sharing
• Power Automate — list flows, trigger flows, view run history

Auth: OAuth 2.0 through Microsoft Graph. Tokens stored locally at ~/.outlook-mcp-tokens.json.

Setup: Register an Azure app, configure permissions, run the auth server on port 3333, authenticate via browser.

What works well

Power Automate integration is unique. No other Outlook MCP server connects to Power Automate. An agent that can read emails, process them, and trigger automation flows creates workflow possibilities that pure email servers can’t match.

Folder management and mail rules. Unlike the official Work IQ server, ryaker supports creating folders, moving messages between folders, and managing Outlook mail rules. These are basic Outlook features that the official server lacks.

Calendar included. Accept/decline invitations, create events — calendar operations are bundled alongside email, which matches how Outlook users actually work.

What doesn’t

Local token storage. Tokens at ~/.outlook-mcp-tokens.json are a security concern. Any process with file system access can read them. Softeria’s approach of using OS credential stores is more secure.

Complex setup. Azure Portal app registration → environment variables → auth server → browser auth → Claude Desktop config. Five steps before your first email read. Community servers for other platforms (like Slack) have gotten this down to two.

No license specified. The repository doesn’t clearly state its license. For enterprise use, this is a blocker — legal teams won’t approve unlicensed dependencies.

merill/lokka — The Graph API Swiss Army Knife

Lokka (291 stars; MIT license) takes a different approach: instead of wrapping specific Microsoft services into dedicated tools, it exposes the Microsoft Graph API itself as an MCP tool.

4 tools:

1. lokka-microsoft — Call any Microsoft Graph or Azure API endpoint
2. set-access-token — Manage authentication tokens dynamically
3. get-auth-status — Check authentication status
4. add-graph-permission — Request additional Graph API scopes interactively (new)

Why this matters: Rather than “search emails” as a tool, Lokka’s approach is “call any Graph API endpoint.” Your agent constructs the Graph API query (/me/messages?$search="subject:invoice") and Lokka executes it. This means every Graph API capability is available, including ones that purpose-built servers haven’t implemented yet.

Auth: Four modes — interactive auth (personal or custom app), app-only auth (certificate or client secret), client-provided tokens, and API version control (beta vs. v1.0).

When to consider it

Lokka is best for users who already know the Microsoft Graph API and want maximum flexibility. It’s the opposite of Softeria’s approach — instead of many purpose-built tools, you get one tool that can do anything. The tradeoff is that your agent needs to know how to construct Graph API queries, which means more complex prompts and more room for errors.

It’s also strong for Azure management tasks — subscriptions, billing, resource management — that pure Outlook servers don’t touch.

Also in the Landscape

pnp/cli-microsoft365-mcp-server (127 stars; MIT) — Wraps the CLI for Microsoft 365 as an MCP server. If you already use m365 CLI commands, this gives your agent the same capabilities. SharePoint, Teams, Planner, and more. Different philosophy from Softeria — this delegates to an established CLI rather than calling Graph API directly.

XenoXilus/outlook-mcp (27 stars) — Email, calendar, and SharePoint integration with Office document parsing (PDF, Word, PowerPoint, Excel). Automatic handling of large files exceeding MCP limits. v1.0.1 (January 2026). Lower adoption but the document parsing angle is unique.

nsakki55/outlook-mcp (1 star) — Auth Code + PKCE flow, no client secret needed. Connects directly to Microsoft Graph API. Useful for scenarios where you can’t store a client secret.

ampcome-mcps/outlook-mcp (1 star, MIT) — 26 tools covering email, contacts, calendar, and folders through Graph API. Uses Nango for credential management (no direct token storage). Comprehensive tool count but minimal adoption and community validation; no commits since mid-2025.

merajmehrabi/Outlook_Calendar_MCP (41 stars) — Windows-only calendar MCP server using local Outlook COM instead of Graph API. Read and manage calendar events from the desktop app; requires Outlook desktop installed. The Windows-only + local Outlook requirement limits its audience severely, and it’s had no commits since September 2025.

kacase/mcp-outlook (8 stars) — Another Graph API wrapper for Outlook. Calendar events, email reading, message sending. Lower adoption.

microsoft/work-iq (976 stars) — Despite the name, this is itself “MCP Server and CLI for accessing Work IQ” — deployable as a standalone MCP server, a CLI, or a GitHub Copilot plugin that queries Microsoft 365 data using natural language. Includes the workiq-productivity plugin with read-only email triage and meeting-cost-analysis skills. Requires Entra ID admin consent.

How Outlook Compares to Gmail

Gmail is more accessible. No paid license requirement for MCP access, a much larger community ecosystem (taylorwilsdon’s ~3,000-star server vs Softeria’s 933), and Google’s own endpoint works without Copilot licensing.

Outlook has deeper enterprise integration. Entra ID auth, compliance policy enforcement, tenant-level controls, DLP rules — the enterprise security infrastructure around Outlook is more mature. If your organization already has Microsoft 365 Copilot licenses, the official server is the obvious choice.

Both have the same fundamental risk. Email is sensitive data. Whether it’s Gmail or Outlook, giving an agent send permissions deserves serious thought. Both ecosystems have the same gap: no official reference server from the MCP project (modelcontextprotocol/servers).

Which Outlook Server Should You Use?

Use Work IQ Mail if your organization has Microsoft 365 Copilot licenses and you want official, hosted, Microsoft-supported email MCP access with KQL search. Accept preview status and the limited 10-tool scope.

Use Softeria/ms-365-mcp-server if you want the broadest Microsoft 365 coverage from a single server, don’t have Copilot licenses, or need features like webhook subscriptions, MIP sensitivity labels, dynamic tool discovery, TOON token optimization, multi-account support, or read-only mode. This is the community standard for a reason — 933 stars, 300+ tools, MIT license, and a release history that’s already past v0.146.0.

Use ryaker/outlook-mcp if you need Power Automate integration alongside email and calendar. The workflow automation angle is unique. Accept the more complex setup and local token storage.

Use merill/lokka if you know the Microsoft Graph API and want maximum flexibility. One tool that can do anything the API supports. Not for beginners.

Wait if you need GA-quality stability from Microsoft. The official servers are in preview and will change. If your workflow can’t tolerate API modifications, the community servers (especially Softeria) are more stable bets despite not having Microsoft’s backing.

The Bottom Line

Rating: 3.5/5 — The official/community split remains the defining characteristic of this ecosystem. Microsoft’s Work IQ Mail server has hosted architecture, KQL search, and enterprise-grade auth — but the Copilot license requirement (~$30/user/month) creates a paywall that’s getting tighter, not looser. The April 15 rollback of Copilot Chat access signals that Microsoft is reinforcing premium boundaries. Then the April 27 Outlook.com outage (sign-in failures that Microsoft traced to a recent configuration change and fixed with a rollback, resolved same day) underscored that every MCP server in this ecosystem depends on Microsoft’s auth infrastructure — when it breaks, nothing works.

Softeria’s ms-365-mcp-server (933 stars, 300+ tools, v0.146.1) has kept releasing steadily since its April sprint (7 releases in one week, adding webhook subscriptions for real-time change notifications, MIP sensitivity labels for enterprise compliance, Excel range writes, OneDrive sharing links, and mail copy/categories/delta sync). The specific bugs flagged in this review’s April audit have all since been closed — but as of late August 2026 its open-issue tracker shows 2 fresh open items filed August 24, including a device-code refresh-token bug, a reminder that the fast release cadence keeps surfacing new issues as fast as old ones close. The pnp/cli-microsoft365-mcp-server is up to 127 stars — the CLI-wrapping approach is finding its audience. ryaker’s Power Automate integration (432 stars) and lokka’s raw Graph API access (291 stars) fill distinct niches.

The ecosystem is less mature than Gmail’s (no dominant server anywhere near taylorwilsdon’s ~3,000 stars, no free official endpoint) but more coherent than Teams’. The star gap between Softeria (933) and Gmail’s taylorwilsdon (~3,000) remains wide. When Microsoft removes the Copilot license requirement or exits preview, this category moves to 4/5. The enterprise security infrastructure is already there; it’s the accessibility that’s holding it back.

This review covers the Microsoft Outlook MCP server landscape as of August 2026 (originally published March 2026). ChatForest researches MCP servers by reading source code, analyzing GitHub repositories and issues, studying documentation, and examining community signals. We do not install or run the servers ourselves. See our methodology for details.

This review was last edited on 2026-08-26 using Claude Sonnet 5 (Anthropic).