Overview
The Microsoft 365 integration brings the power of your Microsoft productivity suite directly into Hatz. Once connected, you get a broad set of tools across Outlook email, Calendar, Contacts, Microsoft Teams, OneDrive, SharePoint, and Excel.
The Microsoft 365 integration uses an Enterprise Application in Microsoft with the necessary permissions to allow Hatz to interact with M365 data.
This is a per-user integration, meaning each user who wants to use Microsoft 365 tools needs to set up the integration.
The Microsoft 365 integration can read, search, and update supported Microsoft resources through the listed tools. It does not save generated files directly to a user's local computer path. For generated files, use the Hatz generated file card or an available Microsoft 365 export/save option.
For Users With the Old M365 Integration
Users who want to access the new tools must disconnect and reconnect the Microsoft 365 integration to obtain the updated permissions.
Steps:
Navigate to the Workshop tab and select Connections on the left
Select the gear icon on the existing Microsoft 365/Outlook integration and delete it
Reconnect using the updated Microsoft 365 integration
Data Safety and Destructive Actions
To keep your information safe, the integration is built around reading, finding, creating, and updating rather than bulk or irreversible removal. It will not delete your emails, OneDrive/SharePoint files, or Teams channels. It can cancel or delete calendar meetings and delete SharePoint list items one at a time, with the protections described in the next section. Before it cancels or deletes a meeting, removes someone's access to a file, or deletes a list item, the agent tells you exactly what it will remove and waits for your yes in the chat. Workflows, scheduled workflows, apps, and email or Slack agents can't do those three things. Within a spreadsheet you are working in, the Excel tools can remove structural elements you ask to change (for example a worksheet, table, row, or column). Everything runs with your own Microsoft permissions and only in response to your instructions, so the integration can never do more than you are able to do yourself.
Sending Email, Saving and Sharing Files, and Updating SharePoint Lists
These capabilities use permissions the integration already requests, so if you use the current Microsoft 365 integration you don't need to reconnect. What an agent can do follows your organization's Microsoft 365 permissions and sharing policies, which your Microsoft 365 administrator (often your MSP) manages. Removing only the Mail.Send permission stops agents sending, replying to, and forwarding email, but Microsoft still emails people when an agent creates, forwards, updates, or cancels a meeting, replies to an invitation, or shares a file, because those use the calendar and file permissions. To stop agents acting in Microsoft 365, remove those permissions too or block the user's access to the Hatz app in Microsoft 365.
Send email
Agents can send new email, reply, reply all, forward messages and meeting invitations, and update and send drafts. Before anything is sent, the agent shows you the message (recipients, subject, and the full text) and sends it only after you approve it in the chat. Otherwise the agent saves a draft.
Formatting the agent writes, such as bold, italic, underline, headings, lists, and tables, appears as formatting in Outlook.
Each send or forward reaches at most 100 recipients across To, Cc, and Bcc, and the result names any recipients outside your organization.
Attachments are copies of the file, including files already in OneDrive or SharePoint, up to 20 files and 150 MB in total at a time, or less if your organization's Microsoft 365 message size limit is lower. Folders can't be attached; ask for a sharing link instead.
If a result says the outcome is unknown, the message may have gone out. Check Sent Items before trying again.
Adding or removing meeting attendees also sends email: attendees get an invitation or a cancellation, so the agent shows you the change and waits for your approval first. An agent won't remove everyone from a meeting; it cancels the meeting instead, after you confirm.
Workflows, apps, and email or Slack agents: there is no one to approve a send, so email is saved as a draft in your Drafts folder for you to review and send, and meeting forwards, attendee changes, and sharing invitations aren't made. A workflow you created can send email without approval when its step instructions say so explicitly, for example "You have full permission to send". Use this for scheduled email workflows.
Cancel and delete meetings
The agent asks you to confirm each cancel or delete in the chat before it happens.
Only the organizer can cancel a meeting, and attendees receive a cancellation with your note. If you are an attendee, decline the meeting.
Deleting sends no note, so it is only for an event with no one else invited, or a meeting that is already cancelled or that you declined.
A past meeting you organized with attendees can't be cancelled or deleted. A recurring series is changed as a whole only when you ask for the whole series, and that removes its past occurrences too.
Save files to OneDrive and SharePoint
Agents can save a file from your chat (up to 100 MB) or write a new text file (.txt, .md, .csv, .tsv, .json, .xml, .yaml, .yml, or .log, up to 4 MB). Other file types, such as an Excel workbook, are created in the chat first and then saved.
If the name is already taken, the file is saved under a new name. An existing file is replaced only when the agent is pointed at that specific file, which saves a new version of it.
Saving a file from your chat follows your workspace's file-download policy. An agent limited to specific OneDrive folders or files saves only inside those folders or as a new version of those files, and attaches only files inside them to email, drafts included.
Share files and folders with people
Agents can share a OneDrive or SharePoint file or folder (not a whole drive or library) with specific people by email address, up to 20 at a time, with view or edit access, after you approve the invitation in the chat. They can also show who has access and stop sharing.
People outside your organization can be invited where your organization's Microsoft 365 sharing policy allows it, and the result names them. Everyone invited must sign in to open the item, and Microsoft emails each person an invitation. You can add a personal note to the invitation.
Agents can also create an "Anyone with the link" link, for viewing or editing, that people outside your organization can open without signing in, where your organization's Microsoft 365 sharing policy allows it. You can ask for the link to expire after a number of days. The agent shows you the file, who can open it, the access, and the expiry, and creates the link only after you approve it in the chat. A link to a folder also opens everything in it, including files added later.
Agents can change someone's access between view and edit after you approve the change in the chat. A link's access can't be changed: remove the link and create a new one. Group access and access inherited from a folder are changed in OneDrive or SharePoint.
Workflows, scheduled workflows, apps, and email or Slack agents can't invite people, create Anyone links, or change who has access: there is no one to approve it.
Sharing a folder shares everything in it, including files added later.
An invitation leaves out anyone it can see already has more access than it grants, so that access isn't lowered, and the result says so. It can't always see everyone's access, for example when you don't own the item, and the result says when that happens.
Stopping sharing removes one person's access, one pending invitation, or one sharing link at a time, and the agent asks you to confirm each one in the chat first. Access through groups or site groups, and owner access, is managed in OneDrive or SharePoint. If access remains through a parent folder, the result says so.
Access an agent grants, and any link it creates, stays in place until someone removes it or the link expires.
Add, update, and delete SharePoint list items
Agents can add, update, and delete items in SharePoint lists. Document libraries, system lists, and hidden lists can't be changed this way; use the file tools for documents.
The agent asks you to confirm each delete in the chat first. Each delete removes one item, and folders can't be deleted. A deleted item goes to the site Recycle Bin, where a site member can restore it for up to 93 days. The agent can't restore it.
Changes an agent makes run the list's alerts and Power Automate flows, which may email people.
An agent limited to specific folders or teams can't change list items.
Common Questions and Troubleshooting
I am attempting to integrate Microsoft 365 and Hatz but I am getting a "Need admin approval" message
This screen is shown when a Global Admin in Microsoft has not configured the integration and granted admin consent
Please reach out to an administrator in your Microsoft 365 tenant and ask them to setup the integration
Once that has been done, try configuring the integration again
Does Hatz need all of the permissions shown when setting up the integration?
Hatz requests access to the permissions for the toolkits that are selected when setting up the integration
You can not select or deselect individual permissions scopes at the time of the integration but once it has been integrated you can edit the permissions within the Enterprise Application in Microsoft if you would like to make it less permissive
Outlook email tools are connected, but I cannot read or draft email
Admin consent and mailbox access are separate. Admin consent allows the Hatz application to request Microsoft permissions for the organization. Each user still needs to connect their own Microsoft 365 account, and Microsoft only returns mailbox data that connected user is allowed to access.
Reconnect Microsoft 365 and make sure the Outlook toolkit is selected during setup. The Outlook toolkit requests mail permissions such as Mail.Read, Mail.ReadWrite, and Mail.Send.
Confirm the signed-in Microsoft user has an active mailbox and can access the same mailbox directly in Outlook on the web. Hatz cannot use a user's connection to bypass Microsoft mailbox permissions.
If the user recently received a new mailbox license, role assignment, or admin consent grant, wait for Microsoft to apply the change, then disconnect and reconnect Microsoft 365 in Hatz.
Will all users have access to all of the data in Microsoft 365?
No - Users will only have access to the data that their user in Microsoft is able to access.
Can I send emails and create OneDrive or SharePoint files with this integration?
Email: yes. Agents can send, reply, and forward email on your behalf when you ask them to send; otherwise they save a draft to your Drafts folder for you to review and send. They can attach files either way.
Files: yes. Agents can save new files to OneDrive/SharePoint, create folders, and move or copy existing files.
See Sending Email, Saving and Sharing Files, and Updating SharePoint Lists above for what agents can do and the limits that apply.
Why can't the assistant see a teammate's Teams status, or list a channel's members?
Reading another person's presence and listing the members of a channel require organization-wide Microsoft permissions that this integration does not request, so those specific actions are not available. You can still check and set your own status, and read and post messages in channels you belong to.
I just created a Teams channel, but updating it fails or says it cannot be found.
Newly created Teams channels take a short time for Microsoft to finish setting up. If an update right after creating the channel fails, wait a minute and try again.
I can't find a past meeting or its transcript.
Past meeting lookups cover roughly the last 90 days, so widen the time range if an older meeting is missing. A meeting's transcript only appears when transcription was turned on for that meeting and you have organizer-level access; otherwise the transcript list comes back empty.
Microsoft now blocks transcript access through the Graph API by default, a change that rolled out at the end of July 2026. This can stop transcripts from working in a tenant where they previously worked, and it applies no matter what permissions the integration already has. A Microsoft Teams administrator has to turn it back on: in the Teams admin center, go to Meetings > Meeting settings, and under Transcript API access set the Microsoft Graph access toggle to On. Speaker names are a separate setting — select Configure and turn on Include speaker attribution (also off by default) if you want the transcript to show who said what.
Administrators can make the same change with PowerShell:
Set-CsTeamsMeetingConfiguration -EnableGraphTranscriptAccess true -EnableAttributedTranscripts true -Identity Global. Microsoft's documentation is here: Manage transcript API access for Teams meetings.
I am not able to perform "X" action within Microsoft 365 through the integration.
This is more than likely due to that action not being supported as a tool for the integration.
Please add this as a feature request or upvote a current request on our Canny board: https://hatz-ai.canny.io/feature-requests
A Microsoft 365 tool shows up but is grayed out when I build an agent
Microsoft 365 is a per-user integration, so its tools stay grayed out in the agent builder until you connect Microsoft 365 with your own account. Select Connect on the tool to link your account, then add it to the agent.
Connecting Microsoft 365 for yourself does not connect it for other people who use the agent. Each user who runs the agent still needs to connect their own Microsoft 365 account, and they will only be able to use the Microsoft data their own account can access.
If the whole tools list is unavailable, check that the agent's selected model supports tools. A model that can't use tools will disable the tool picker.
A Microsoft 365 tool shows a "Locked" badge and I can't turn it on
A Locked badge means an administrator has turned off access to that integration at a higher level, so it can't be enabled where you are.
The lock message names who to contact: if it is locked by your organization, contact your administrator; if it is locked by your Managed Service Provider, contact your MSP administrator; if it is locked by platform-level policy, it is set for the whole platform and can't be changed in your own settings.
To unlock it, the administrator who controls that level re-enables access for the Microsoft 365 integration in their admin access settings. Once access is allowed again, the tool can be turned on.
My Microsoft 365 tools stop working partway through a long chat
Hatz normally refreshes your Microsoft session automatically in the background, so most long conversations keep working without any action from you.
The connection can drop mid-chat if Microsoft ends the session and it can't be renewed — most often after you change your Microsoft password, or an administrator revokes the app's consent or changes a Microsoft policy.
If Microsoft 365 tools start failing during an active chat, reconnect Microsoft 365 from the Workshop tab under Connections, then continue. If it keeps dropping, ask your Microsoft 365 administrator to confirm the integration's consent and any sign-in or session policies that may be ending the connection.
How do Microsoft 365 and SharePoint tools authenticate when an agent is triggered through the API?
When an agent runs through the API, its Microsoft 365 and SharePoint tools act as the user who owns the API key. There is no separate shared or service-account connection for API runs.
That means the API key's owner must have personally connected Microsoft 365 and keep the connection active, and the tools can only reach the Microsoft data that user's own account can access.
If the key owner has not connected Microsoft 365, or the connection has expired, the Microsoft 365 and SharePoint tools return an error asking to reconnect the account. Have the key owner connect or reconnect Microsoft 365 from the Workshop tab under Connections.