{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "outlook-mail-graph", "name": "Outlook Mail (Microsoft Graph)", "vendor": "Microsoft", "vendorUrl": "https://learn.microsoft.com/en-us/graph/api/resources/mail-api-overview", "kind": "http-api", "category": "mailbox-access", "summary": "Mail endpoints of Microsoft Graph for Outlook, Microsoft 365 and Exchange Online mailboxes. An app reads, searches, drafts, sends and files messages over REST with OAuth tokens from Microsoft Entra ID.", "url": "https://www.anchorterminal.com/tools/outlook-mail-graph", "markdownUrl": "https://www.anchorterminal.com/tools/outlook-mail-graph.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/outlook-mail-graph.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/outlook-mail-graph.json", "repo": "https://github.com/microsoftgraph/msgraph-sdk-javascript", "license": "MIT (SDKs)", "transports": [ "http" ], "remoteUrl": "https://graph.microsoft.com/v1.0", "packages": [ { "registry": "npm", "name": "@microsoft/microsoft-graph-client" }, { "registry": "pypi", "name": "msgraph-sdk" } ], "auth": "oauth", "authNotes": "OAuth 2.0 tokens from Microsoft Entra ID, after a person registers an app. No app review by Microsoft was found for mail permissions. Delegated permissions (Mail.ReadBasic, Mail.Read, Mail.ReadWrite, Mail.Send) act as a signed-in user and need only that user's consent. Application permissions reach every mailbox in a tenant, need admin consent, and can be limited to chosen mailboxes with RBAC for Applications in Exchange Online. Personal Outlook.com accounts work with delegated permissions.", "pricing": "byo-plan", "pricingNotes": "Mail calls aren't metered. The only metered Graph API is SharePoint and OneDrive `assignSensitivityLabel` at $0.00185 a call (https://learn.microsoft.com/en-us/graph/metered-api-list). A work mailbox needs an Exchange Online or Microsoft 365 licence, and Microsoft's plan price page refused our reader on 8 October 2026. A free personal Outlook.com account lets an agent start without a contract. The Microsoft 365 developer programme sandbox is free only to members who qualify, such as Visual Studio subscribers. The Mail MCP server needs a Microsoft 365 Copilot licence.", "priceSummary": "Your plan", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Graph mail reference or the metered API list (checked 2026-10-08).", "endpoints": [] }, "toolCount": 10, "popularity": { "githubStars": 835, "npmWeekly": 2882852, "pypiWeekly": 1578201, "asOf": "2026-10-08" }, "docsUrl": "https://learn.microsoft.com/en-us/graph/api/resources/mail-api-overview", "openapi": "https://raw.githubusercontent.com/microsoftgraph/msgraph-metadata/master/openapi/v1.0/openapi.yaml", "capabilities": [ "mailbox.read", "mailbox.search", "mailbox.send", "mailbox.drafts", "mailbox.sync" ], "tags": [ "hosted", "official", "oauth", "openapi", "webhooks", "typescript", "python", "enterprise" ], "lastRelease": "2026-10-06", "graded": true, "anchor": { "graded": true, "score": 66.3, "grade": "B", "agentReady": false, "rank": 221, "ranked": true, "rankOf": 629, "categoryRank": 4, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 81, "maintenance": 76, "payments": 35, "reliability": 60, "schema": 93, "security": 71, "transparency": 75 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 60, "points": 12, "reason": "Graded on the v1.0 REST API. A public Microsoft service health page at status.cloud.microsoft (20). It renders only with JavaScript, so we couldn't read components or history (5). Outlook limits are published at 10,000 requests per 10 minutes, four concurrent requests and 150 MB of uploads per 5 minutes for each app and mailbox pair, and Exchange Online caps sending at 30 messages a minute and 10,000 recipients a day (15). 429 responses carry `Retry-After`, with backoff guidance and SDK retry handlers, but sendMail has no idempotency key and returns 202 Accepted before delivery, so a retried send can duplicate (10 of 15). No SLA covering the Graph API was found in the pages we could read, and the Online Services SLA page refused our reader (0). Mail endpoints are generally available on v1.0 (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 93, "points": 15.11, "reason": "OpenAPI for all of Graph v1.0 in microsoftgraph/msgraph-metadata (25). No llms.txt on learn.microsoft.com, but every reference page we asked for with `Accept: text/markdown` came back as Markdown (10). Reference pages state the purpose of each call, list permissions from least to most privileged and name limits such as the `$filter` and `$orderby` ordering rule and the 1,000-result cap on `$search` (17). Typed properties and enumerations in the metadata, though sendMail also accepts a base64 MIME blob (13). An example request and response on each page, a shared error format and a status code table, with few mail-specific error codes listed (13). v1.0 and beta, a dated changelog and a monthly What's new page updated on 8 October 2026 (15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 81, "points": 13.16, "reason": "`$select`, `$top`, `bodyPreview` (255 characters), `uniqueBody` and `Prefer: outlook.body-content-type=\"text\"` keep message payloads small (23). `@odata.nextLink` paging with pages of 1 to 1,000, `$filter`, `$orderby`, `$search` and per-folder delta queries (20). Errors carry a code, message and request ID, and named codes such as `InefficientFilter` say what to change (17). Immutable IDs through a `Prefer` header and `If-Match` on updates help safe retries, but sendMail, reply and forward have no idempotency key, and the preview Mail MCP reference lists no readOnlyHint or destructiveHint annotations (8). Official SDKs in C#, Java, Go, PHP, Python, PowerShell and TypeScript, though the JavaScript client on npm is 3.0.7 from September 2023 (13)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 71, "points": 12.43, "reason": "OAuth 2.0 through Microsoft Entra ID with delegated and application permissions, from Mail.ReadBasic through Mail.Read and Mail.ReadWrite to a separate Mail.Send (30). Mail.ReadBasic leaves out body, preview and attachments, Mail.ReadWrite doesn't include sending, and RBAC for Applications in Exchange Online limits an application permission to chosen mailboxes. Nothing asks for confirmation before a send or delete (17). Message bodies written by outside senders reach the caller, and no injection guidance was found in the mail reference or the Mail MCP reference (0). Graph activity logs record app, user, IP address, request URI and scopes, but need Entra ID P1 or P2 and an Azure log destination (12). microsoft.com's security.txt names the MSRC report portal, a bounty policy and a disclosure policy but passed its Expires date on 23 September 2026, Office 365 has a SOC 2 Type 2 report, and a token-leak fix in the JavaScript client sits unreleased with no advisory (12)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 35, "points": 4.38, "reason": "No x402, MPP or L402 (0). Mail endpoints aren't on the metered API list, so calls carry no charge, but a work mailbox needs an Exchange Online or Microsoft 365 licence and the plan price page refused our reader (15). Personal Outlook.com accounts work with delegated Mail permissions at no cost and no card (20). A person registers an app in Entra and, for application permissions, an admin consents (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 76, "points": 6.65, "reason": "msgraph-sdk-python v1.64.0 on 6 October 2026 (30). Eight Python SDK tags since 10 July 2026, from v1.59.0 to v1.64.0 (20). A public changelog, a What's new page updated on 8 October 2026 and SDK issue trackers, but a security fix merged into the JavaScript client on 16 June 2026 still hasn't reached npm, and the changelog feed's newest entry is 3 August 2026 (10). Current SDKs in most languages, with the JavaScript client the exception at 3.0.7 (10). Active tagging on the Python repository, none of it reaching the JavaScript package (6)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 75, "points": 6.56, "note": "editorial 65, provenance 85", "reason": "Closed service under the Microsoft APIs terms of use, last updated October 2025, with MIT SDKs (15). Microsoft 365's retention page says deleted customer content is removed within 30 days and within 180 days of a subscription ending, and the Exchange Online residency page names where mailbox content is stored. The privacy statement refused our reader and we didn't read the data protection addendum (20). A written policy of at least 24 months' notice before a v1.0 API or version is retired, and dated notices such as the Exchange Web Services retirement (20). Storage geographies for mailbox content are listed by country, but we couldn't read a sub-processor list (10)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "`$select`, `$top`, `bodyPreview` (255 characters), `uniqueBody` and `Prefer: outlook.body-content-type=\"text\"` keep message payloads small (23). `@odata.nextLink` paging with pages of 1 to 1,000, `$filter`, `$orderby`, `$search` and per-folder delta queries (20). Errors carry a code, message and request ID, and named codes such as `InefficientFilter` say what to change (17). Immutable IDs through a `Prefer` header and `If-Match` on updates help safe retries, but sendMail, reply and forward have no idempotency key, and the preview Mail MCP reference lists no readOnlyHint or destructiveHint annotations (8). Official SDKs in C#, Java, Go, PHP, Python, PowerShell and TypeScript, though the JavaScript client on npm is 3.0.7 from September 2023 (13).", "maintenance": "msgraph-sdk-python v1.64.0 on 6 October 2026 (30). Eight Python SDK tags since 10 July 2026, from v1.59.0 to v1.64.0 (20). A public changelog, a What's new page updated on 8 October 2026 and SDK issue trackers, but a security fix merged into the JavaScript client on 16 June 2026 still hasn't reached npm, and the changelog feed's newest entry is 3 August 2026 (10). Current SDKs in most languages, with the JavaScript client the exception at 3.0.7 (10). Active tagging on the Python repository, none of it reaching the JavaScript package (6).", "payments": "No x402, MPP or L402 (0). Mail endpoints aren't on the metered API list, so calls carry no charge, but a work mailbox needs an Exchange Online or Microsoft 365 licence and the plan price page refused our reader (15). Personal Outlook.com accounts work with delegated Mail permissions at no cost and no card (20). A person registers an app in Entra and, for application permissions, an admin consents (0).", "reliability": "Graded on the v1.0 REST API. A public Microsoft service health page at status.cloud.microsoft (20). It renders only with JavaScript, so we couldn't read components or history (5). Outlook limits are published at 10,000 requests per 10 minutes, four concurrent requests and 150 MB of uploads per 5 minutes for each app and mailbox pair, and Exchange Online caps sending at 30 messages a minute and 10,000 recipients a day (15). 429 responses carry `Retry-After`, with backoff guidance and SDK retry handlers, but sendMail has no idempotency key and returns 202 Accepted before delivery, so a retried send can duplicate (10 of 15). No SLA covering the Graph API was found in the pages we could read, and the Online Services SLA page refused our reader (0). Mail endpoints are generally available on v1.0 (10).", "schema": "OpenAPI for all of Graph v1.0 in microsoftgraph/msgraph-metadata (25). No llms.txt on learn.microsoft.com, but every reference page we asked for with `Accept: text/markdown` came back as Markdown (10). Reference pages state the purpose of each call, list permissions from least to most privileged and name limits such as the `$filter` and `$orderby` ordering rule and the 1,000-result cap on `$search` (17). Typed properties and enumerations in the metadata, though sendMail also accepts a base64 MIME blob (13). An example request and response on each page, a shared error format and a status code table, with few mail-specific error codes listed (13). v1.0 and beta, a dated changelog and a monthly What's new page updated on 8 October 2026 (15).", "security": "OAuth 2.0 through Microsoft Entra ID with delegated and application permissions, from Mail.ReadBasic through Mail.Read and Mail.ReadWrite to a separate Mail.Send (30). Mail.ReadBasic leaves out body, preview and attachments, Mail.ReadWrite doesn't include sending, and RBAC for Applications in Exchange Online limits an application permission to chosen mailboxes. Nothing asks for confirmation before a send or delete (17). Message bodies written by outside senders reach the caller, and no injection guidance was found in the mail reference or the Mail MCP reference (0). Graph activity logs record app, user, IP address, request URI and scopes, but need Entra ID P1 or P2 and an Azure log destination (12). microsoft.com's security.txt names the MSRC report portal, a bounty policy and a disclosure policy but passed its Expires date on 23 September 2026, Office 365 has a SOC 2 Type 2 report, and a token-leak fix in the JavaScript client sits unreleased with no advisory (12).", "transparency": "Closed service under the Microsoft APIs terms of use, last updated October 2025, with MIT SDKs (15). Microsoft 365's retention page says deleted customer content is removed within 30 days and within 180 days of a subscription ending, and the Exchange Online residency page names where mailbox content is stored. The privacy statement refused our reader and we didn't read the data protection addendum (20). A written policy of at least 24 months' notice before a v1.0 API or version is retired, and dated notices such as the Exchange Web Services retirement (20). Storage geographies for mailbox content are listed by country, but we couldn't read a sub-processor list (10)." }, "sources": [ { "what": "mail API overview", "url": "https://learn.microsoft.com/en-us/graph/api/resources/mail-api-overview?view=graph-rest-1.0", "seen": "2026-10-08" }, { "what": "throttling limits for Outlook", "url": "https://learn.microsoft.com/en-us/graph/throttling-limits", "seen": "2026-10-08" }, { "what": "throttling guidance and Retry-After", "url": "https://learn.microsoft.com/en-us/graph/throttling", "seen": "2026-10-08" }, { "what": "list messages reference and permissions", "url": "https://learn.microsoft.com/en-us/graph/api/user-list-messages?view=graph-rest-1.0", "seen": "2026-10-08" }, { "what": "sendMail reference", "url": "https://learn.microsoft.com/en-us/graph/api/user-sendmail?view=graph-rest-1.0", "seen": "2026-10-08" }, { "what": "send mail process", "url": "https://learn.microsoft.com/en-us/graph/outlook-things-to-know-about-send-mail", "seen": "2026-10-08" }, { "what": "create draft message reference", "url": "https://learn.microsoft.com/en-us/graph/api/user-post-messages?view=graph-rest-1.0", "seen": "2026-10-08" }, { "what": "message delta reference", "url": "https://learn.microsoft.com/en-us/graph/api/message-delta?view=graph-rest-1.0", "seen": "2026-10-08" }, { "what": "subscription lifetimes", "url": "https://learn.microsoft.com/en-us/graph/api/resources/subscription?view=graph-rest-1.0", "seen": "2026-10-08" }, { "what": "lifecycle notifications", "url": "https://learn.microsoft.com/en-us/graph/change-notifications-lifecycle-events", "seen": "2026-10-08" }, { "what": "$search on messages", "url": "https://learn.microsoft.com/en-us/graph/search-query-parameter", "seen": "2026-10-08" }, { "what": "Microsoft Search API for messages", "url": "https://learn.microsoft.com/en-us/graph/search-concept-messages", "seen": "2026-10-08" }, { "what": "permissions reference, Mail permissions", "url": "https://learn.microsoft.com/en-us/graph/permissions-reference", "seen": "2026-10-08" }, { "what": "RBAC for Applications in Exchange Online", "url": "https://learn.microsoft.com/en-us/graph/auth-limit-mailbox-access", "seen": "2026-10-08" }, { "what": "Graph activity logs", "url": "https://learn.microsoft.com/en-us/graph/microsoft-graph-activity-logs-overview", "seen": "2026-10-08" }, { "what": "immutable IDs", "url": "https://learn.microsoft.com/en-us/graph/outlook-immutable-id", "seen": "2026-10-08" }, { "what": "JSON batching", "url": "https://learn.microsoft.com/en-us/graph/json-batching", "seen": "2026-10-08" }, { "what": "error responses", "url": "https://learn.microsoft.com/en-us/graph/errors", "seen": "2026-10-08" }, { "what": "versioning, support and breaking change policy", "url": "https://learn.microsoft.com/en-us/graph/versioning-and-support", "seen": "2026-10-08" }, { "what": "What's new in Microsoft Graph", "url": "https://learn.microsoft.com/en-us/graph/whats-new-overview", "seen": "2026-10-08" }, { "what": "Graph changelog feed", "url": "https://developer.microsoft.com/en-us/graph/changelog/rss", "seen": "2026-10-08" }, { "what": "metered API list", "url": "https://learn.microsoft.com/en-us/graph/metered-api-list", "seen": "2026-10-08" }, { "what": "Exchange Online sending limits", "url": "https://learn.microsoft.com/en-us/office365/servicedescriptions/exchange-online-service-description/exchange-online-limits", "seen": "2026-10-08" }, { "what": "Exchange Online service description, EWS retirement", "url": "https://learn.microsoft.com/en-us/office365/servicedescriptions/exchange-online-service-description/exchange-online-service-description", "seen": "2026-10-08" }, { "what": "Mail MCP reference (preview)", "url": "https://learn.microsoft.com/en-us/microsoft-copilot-studio/mcp-mail-tools", "seen": "2026-10-08" }, { "what": "Work IQ MCP overview and licence", "url": "https://learn.microsoft.com/en-us/microsoft-agent-365/tooling-servers-overview", "seen": "2026-10-08" }, { "what": "Microsoft APIs terms of use", "url": "https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use", "seen": "2026-10-08" }, { "what": "Microsoft 365 data retention and deletion", "url": "https://learn.microsoft.com/en-us/compliance/assurance/assurance-data-retention-deletion-and-destruction-overview", "seen": "2026-10-08" }, { "what": "data residency for Exchange Online", "url": "https://learn.microsoft.com/en-us/microsoft-365/enterprise/m365-dr-workload-exo", "seen": "2026-10-08" }, { "what": "SOC 2 Type 2 for Office 365", "url": "https://learn.microsoft.com/en-us/compliance/regulatory/offering-soc-2", "seen": "2026-10-08" }, { "what": "Microsoft 365 developer programme FAQ", "url": "https://learn.microsoft.com/en-us/office/developer-program/microsoft-365-developer-program-faq", "seen": "2026-10-08" }, { "what": "security.txt (Expires 2026-09-23)", "url": "https://www.microsoft.com/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "service health page (JavaScript only)", "url": "https://status.cloud.microsoft/", "seen": "2026-10-08" }, { "what": "OpenAPI and CSDL metadata", "url": "https://github.com/microsoftgraph/msgraph-metadata", "seen": "2026-10-08" }, { "what": "JavaScript client repository and token-leak fix", "url": "https://github.com/microsoftgraph/msgraph-sdk-javascript", "seen": "2026-10-08" }, { "what": "npm latest for @microsoft/microsoft-graph-client", "url": "https://registry.npmjs.org/@microsoft/microsoft-graph-client/latest", "seen": "2026-10-08" }, { "what": "Python SDK tags", "url": "https://github.com/microsoftgraph/msgraph-sdk-python", "seen": "2026-10-08" }, { "what": "SDK overview", "url": "https://learn.microsoft.com/en-us/graph/sdks/sdks-overview", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: status page components and incident history, which need JavaScript", "unchecked: the Online Services SLA and Exchange Online plan prices, because www.microsoft.com answered our reader with 403", "unchecked: the Microsoft privacy statement, the MSRC bounty pages, the data protection addendum and the Microsoft 365 sub-processor list, which refused our reader or weren't found", "Whether Microsoft will publish msgraph-sdk-javascript 3.0.8 or an advisory for the 16 June 2026 fix", "Whether the Mail MCP tools carry readOnlyHint or destructiveHint annotations. The reference lists none", "The changelog feed's newest entry is 3 August 2026 while the What's new page was updated on 8 October 2026. We didn't establish why the feed stops there", "lastRelease is the Python SDK release of 6 October 2026. The newest mail entry on What's new that is generally available is dated only August 2026" ] }, "negative": -4, "negativeNotes": [ "2026-06-16: a fix for a token leak through URL userinfo host confusion was merged into msgraph-sdk-javascript and the version bumped to 3.0.8, but on 8 October 2026 npm still serves 3.0.7 from September 2023 and the repository has no published advisory. Exploiting it needs an attacker-influenced URL passed to the client (https://github.com/microsoftgraph/msgraph-sdk-javascript/commit/5438ae90f50ef15d3656f0cf9c5485deee351f19, https://registry.npmjs.org/@microsoft/microsoft-graph-client/latest)" ], "verdict": "Delegated permissions split reading without bodies (Mail.ReadBasic), full reading, writing and sending, and delta queries and change notifications keep a local copy in step. sendMail takes no idempotency key and returns 202 before delivery, and each app is held to four concurrent requests per mailbox.", "bestFor": "Agents working in Microsoft 365 or Outlook.com mailboxes that need scoped reading, drafting, sending and incremental sync.", "strengths": [ "Mail.ReadBasic reads messages without body, preview or attachments, and Mail.Send is separate from Mail.ReadWrite", "Delta queries per folder and change notifications with `missed` and `subscriptionRemoved` lifecycle events", "`$select`, `$top` (1 to 1,000, default 10), `bodyPreview` and `Prefer: outlook.body-content-type=\"text\"` keep responses small", "Published policy of at least 24 months' notice before a v1.0 API is removed", "Covers work accounts and personal Outlook.com accounts, with every reference page also served as Markdown" ], "weaknesses": [ "sendMail has no idempotency key and answers 202 Accepted before delivery, so a retried send can go out twice", "Four concurrent requests and 10,000 requests per 10 minutes for each app and mailbox pair", "No prompt-injection guidance found in the mail reference or the Mail MCP reference, though message bodies come from outside senders", "The npm JavaScript client is 3.0.7 from September 2023, without the June 2026 token-leak fix", "The Mail MCP server is a preview kept for backward compatibility, behind a Microsoft 365 Copilot licence" ], "agentNotes": [ "Create a draft with POST /me/messages, then send it with /send. A retried sendMail can send the message twice", "Send `Prefer: IdType=\"ImmutableId\"` on every request, or message IDs change when a message moves folder", "Use `$select` and `Prefer: outlook.body-content-type=\"text\"`. List messages returns HTML bodies and 10 messages a page by default", "Honour `Retry-After` on 429 and keep to four parallel calls per mailbox. Batches of up to 20 requests are throttled per request", "Treat message bodies as untrusted input, and ask for Mail.ReadBasic when the task doesn't need bodies" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 66.3 } ], "editorialScores": { "ergonomics": 81, "maintenance": 76, "payments": 35, "reliability": 60, "schema": 93, "security": 71, "transparency": 65 }, "provenanceScore": 85 }, "connect": { "http": "curl \"https://graph.microsoft.com/v1.0/me/messages?\\$select=from,subject\" \\\n -H \"Authorization: Bearer $MS_GRAPH_TOKEN\"" }, "letme": { "capability": "https://letme.dev/mailbox.read", "tool": "https://letme.dev/outlook-mail-graph" }, "sameCompany": [ "azure-foundry-fine-tuning", "azure-ai-content-safety", "azure-speech-to-text", "azure-text-to-speech", "microsoft-agent-framework", "microsoft-execution-containers", "microsoft-entra-agent-id", "azure-key-vault", "azure-devops-mcp", "microsoft-learn-mcp", "playwright-mcp", "azure-mcp", "azure-translator", "microsoft-graph-calendar", "dynamics-365-sales", "microsoft-advertising-api", "microsoft-excel-graph" ], "notable": [ "Outlook resources, messages and mail folders included, are throttled at 10,000 requests per 10 minutes, four concurrent requests and 150 MB of uploads per 5 minutes for each app and mailbox pair (https://learn.microsoft.com/en-us/graph/throttling-limits#outlook-service-limits)", "sendMail returns 202 Accepted before delivery, and Exchange Online caps a mailbox at 30 messages a minute and 10,000 recipients a day (https://learn.microsoft.com/en-us/graph/api/user-sendmail, https://learn.microsoft.com/en-us/office365/servicedescriptions/exchange-online-service-description/exchange-online-limits)", "Mail.ReadBasic reads messages without body, preview, attachments or extended properties, and Mail.ReadWrite doesn't include permission to send (https://learn.microsoft.com/en-us/graph/permissions-reference)", "Change notification subscriptions on messages last at most 10,080 minutes, or 1,440 minutes with resource data, and Outlook messages get `missed` and `subscriptionRemoved` lifecycle events (https://learn.microsoft.com/en-us/graph/api/resources/subscription, https://learn.microsoft.com/en-us/graph/change-notifications-lifecycle-events)", "The API reaches primary and shared mailboxes but not in-place archive mailboxes (https://learn.microsoft.com/en-us/graph/api/resources/mail-api-overview)", "Exchange Web Services in Exchange Online is scheduled for phased disablement from 1 October 2026 and retirement on 1 April 2027, with Microsoft Graph named as the replacement (https://learn.microsoft.com/en-us/office365/servicedescriptions/exchange-online-service-description/exchange-online-service-description)", "The Mail MCP server (`mcp_MailTools`) has 10 tools, is in preview, and Microsoft says it shouldn't be used in production or new projects (https://learn.microsoft.com/en-us/microsoft-copilot-studio/mcp-mail-tools)", "The Microsoft APIs terms of use limit use of mail APIs to syncing and backing up mail, calendar and contacts unless customers expressly grant other uses (https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use)" ], "area": "communication", "details": [ { "label": "Graded surface", "value": "The v1.0 REST API at https://graph.microsoft.com/v1.0. The Mail MCP server is a preview and wasn't graded" }, { "label": "Free tier", "value": "No charge for mail calls. A personal Outlook.com account is free, and a work mailbox needs an Exchange Online or Microsoft 365 licence" }, { "label": "Permissions", "value": "Mail.ReadBasic, Mail.Read, Mail.ReadWrite and Mail.Send, each delegated or application, plus .Shared variants for shared and delegated mailboxes on work accounts" }, { "label": "Rate limits", "value": "10,000 requests per 10 minutes, four concurrent requests and 150 MB of uploads per 5 minutes for each app and mailbox pair" }, { "label": "Send limits", "value": "Exchange Online allows 30 messages a minute and 10,000 recipients a day per mailbox" }, { "label": "Search", "value": "`$search` on message collections returns up to 1,000 results and looks in from, subject and body by default. The Microsoft Search API (POST /search/query) also searches attachments, for work accounts and the signed-in user's own mailbox only" }, { "label": "Paging", "value": "`$top` from 1 to 1,000, default 10, with `@odata.nextLink`" }, { "label": "Sync", "value": "Per-folder delta queries with `@odata.deltaLink`, and change notifications by webhook" }, { "label": "Change notifications", "value": "Message subscriptions last up to 10,080 minutes, or 1,440 with resource data" }, { "label": "Batching", "value": "Up to 20 requests in one JSON batch, sent to Outlook four at a time" }, { "label": "Accounts", "value": "Microsoft 365 and Exchange Online work accounts, shared mailboxes and personal Outlook.com. In-place archive mailboxes aren't reachable" }, { "label": "SDKs", "value": "C#, Java, Go, PHP, Python (msgraph-sdk 1.64.0, 6 October 2026), PowerShell, a CLI and TypeScript (npm 3.0.7, September 2023)" }, { "label": "MCP server", "value": "Mail (`mcp_MailTools`), 10 tools, preview, per-tenant endpoint on agent365.svc.cloud.microsoft, Microsoft 365 Copilot licence" }, { "label": "Deprecation", "value": "At least 24 months' notice before a v1.0 API or version is retired" } ], "provenance": { "legalEntity": "Microsoft Corporation", "domain": "microsoft.com", "domainRegistered": "1991-05-02", "domainNote": "The endpoint is on graph.microsoft.com. microsoft.com publishes a security.txt, but it passed its Expires date on 2026-09-23.", "endpointOnVendorDomain": true, "terms": "https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use", "privacy": "https://privacy.microsoft.com/en-us/privacystatement", "statusPage": "https://status.cloud.microsoft", "changelog": "https://developer.microsoft.com/en-us/graph/changelog", "securityTxt": "expired", "checked": "2026-10-08", "notes": [ "The Microsoft service health page at status.cloud.microsoft needs JavaScript to show anything.", "The Microsoft APIs terms of use say they were last updated in October 2025.", "privacy.microsoft.com answered our reader with 403 on 8 October 2026, so the privacy URL follows the Microsoft Graph calendar listing and wasn't reread.", "RDAP for microsoft.com gives a registration date of 1991-05-02." ], "score": 85, "checks": [ { "check": "Legal entity named", "value": "Microsoft Corporation", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "microsoft.com, registered 1991-05-02 (35 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "graph.microsoft.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 5 of the 7 things a reader expects, and has 3 clauses that cost points", "points": 2.3, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects, and has 1 clause that costs points", "points": 8, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.cloud.microsoft", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "published but past its Expires date", "points": 5, "max": 10, "state": "part" } ], "policies": [ { "kind": "terms", "url": "https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use", "state": "read", "readAt": "2026-10-08", "statedDate": "2025-10-01", "words": 4555, "points": 2.3, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: October 2025 What's new?", "says": "Last updated 2025-10-01" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": false }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "WE MAKE NO WARRANTIES, EXPRESS OR IMPLIED, GUARANTEES OR CONDITIONS WITH RESPECT TO YOUR USE OF THE MICROSOFT APIs." }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "We may change, amend or terminate these API Terms at any time." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "WE MAY MODIFY THESE API TERMS AT ANY TIME, WITH OR WITHOUT PRIOR NOTICE TO YOU.", "says": "Says it gives notice of a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "Unless you have use permissions expressly and specifically granted by Customers in connection with using your Application, you may not use Microsoft email protocols and APIs for any purpose other than:" }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "Scrape, build databases or otherwise create copies of any data accessed or obtained using the Microsoft APIs, except as necessary to enable an intended usage scenario for your Application;", "costsPoints": true }, { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "Use the Microsoft APIs, or any data obtained using the Microsoft APIs, to conduct performance testing of a Microsoft Offering unless expressly permitted by Microsoft", "costsPoints": true }, { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "WE MAY MODIFY THESE API TERMS AT ANY TIME, WITH OR WITHOUT PRIOR NOTICE TO YOU.", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "We may suspend or immediately terminate these API Terms, any rights granted herein, and/or your license to the Microsoft APIs, in our sole discretion at any time, for any reason." } ], "notes": [ { "date": "2026-10-08", "text": "Recoverable damages are limited to direct damages of up to 5 US dollars in total.", "quote": "YOU AGREE THAT YOUR EXCLUSIVE REMEDY IS TO RECOVER, FROM MICROSOFT OR ANY AFFILIATES, RESELLERS, DISTRIBUTORS, SUPPLIERS (AND RESPECTIVE EMPLOYEES, SHAREHOLDERS, OR DIRECTORS) AND VENDORS, ONLY DIRECT DAMAGES UP TO USD $5.00 COLLECTIVELY." }, { "date": "2026-10-08", "text": "After a data breach involving the Microsoft APIs, the developer may make no public statement about it without Microsoft's prior written permission.", "quote": "You agree to refrain from making public statements (e.g., press, blogs, social media, bulletin boards, etc.) without prior written and express permission from Microsoft in each instance as it relates to the Microsoft APIs." }, { "date": "2026-10-08", "text": "The developer must allow Microsoft reasonable access to its application so Microsoft can monitor compliance with the API terms.", "quote": "You will permit Microsoft reasonable access to your Application for purposes of monitoring compliance with these API Terms." } ] }, { "kind": "privacy", "url": "https://privacy.microsoft.com/en-us/privacystatement", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-09-01", "words": 33580, "points": 8, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: September 2026", "says": "Last updated 2026-09-01" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "The data we collect depends on the context of your interactions with Microsoft and the choices you make, including your privacy settings and the products and features you use." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "When you delete an email or item from a mailbox in Outlook.com, the item generally goes into your Deleted Items folder where it remains for approximately 7 days unless you move it back to your inbox, you empty the folder, or the service empties the folder automatically, whichever comes first.", "says": "Names a period of 7 days" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Service providers that help us determine your device’s location." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "not use or share student personal data for advertising or similar commercial purposes, such as providing personalized advertising to students;" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "State Data Privacy Notice (including notice at collection details) and the Consumer Health Data Privacy Policy for additional information about your rights and the processing of your personal data." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have a privacy concern, complaint, or question for the Microsoft privacy team or Data Protection Officer, please visit our privacy support and requests page and click on “Contact the Microsoft privacy team or the Microsoft Data Protection Officer” menu.", "says": "Names a data protection officer" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "In such cases, we implement legal safeguards-such as standard contractual clauses approved by the European Commission – to help protect your rights and ensure your data remains protected.", "says": "Relies on standard contractual clauses" } ], "toKnow": [ { "key": "training", "label": "Says it may use customer content to train or improve models, and no opt-out was found", "found": true, "quote": "As part of our efforts to improve and develop our products, we may use your data to develop and train our AI models.", "costsPoints": true }, { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "We also disclose personal data for digital advertising purposes." } ], "notes": [ { "date": "2026-10-08", "text": "For enterprise and developer products, the customer's agreement with Microsoft takes precedence over this privacy statement where the two conflict.", "quote": "In the event of a conflict between our privacy statement and the terms of any agreement(s) between a customer and Microsoft for Enterprise and Developer Products, the terms of those agreement(s) will control." }, { "date": "2026-10-08", "text": "Advertisements may be chosen from the current interaction, including Copilot conversations and files shared in them.", "quote": "Ads may be shown that relate to the current interaction you are having with us, such as your Copilot conversations (including files you share); your current location; transactions; product usage; search queries; or the content you’re viewing." }, { "date": "2026-10-08", "text": "Microsoft staff manually review some results of automated systems, including AI, against the source data.", "quote": "For example, to build, train, and improve the accuracy of our automated systems – such as AI - we manually review some of the results against the underlying data." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/outlook-mail-graph.json", "live": { "slug": "outlook-mail-graph", "probe": { "target": "https://graph.microsoft.com/v1.0", "method": "get", "lastAt": "2026-10-08T18:20:36.817208295Z", "lastOk": true, "lastStatus": 200, "lastMs": 2, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 5, "p95ms24h": 30, "samples24h": 33, "samples30d": 33, "days": [ { "date": "2026-10-08", "probes": 33, "ok": 33 } ] }, "versions": [ { "registry": "github", "name": "microsoftgraph/msgraph-sdk-javascript", "version": "3.0.7", "released": "2023-09-19", "seenAt": "2026-10-08T16:24:30.348454398Z" }, { "registry": "npm", "name": "@microsoft/microsoft-graph-client", "version": "3.0.7", "seenAt": "2026-10-08T16:24:29.99296352Z" }, { "registry": "pypi", "name": "msgraph-sdk", "version": "1.64.0", "released": "2026-10-06", "seenAt": "2026-10-08T16:24:30.234677595Z" } ], "githubStars": 835, "npmWeekly": 2882852, "pypiWeekly": 1578201, "securityTxt": { "url": "https://microsoft.com/.well-known/security.txt", "state": "expired", "expires": "2026-09-23T16:00:00.000Z", "checkedAt": "2026-10-08T15:39:08.216544687Z" }, "updatedAt": "2026-10-08T18:20:36.817208295Z" } } }