Outlook Trigger

This trigger receives email received events from Microsoft Outlook and triggers a workflow.

Upgrade Notes for 1.0.0

Review the saved value after upgrading.
Use a tenant ID or domain for single-tenant apps, for work or school accounts only, or only when personal Microsoft accounts are required.
The field remains secret-style in Dify for compatibility with existing saved configurations.

Set up

1. Enter Azure Portal, head to and create a new application.

Fill with a name and choose the supported account type that matches your tenant policy.
For company-only access, choose single tenant and use the Directory tenant ID in Dify.
For organization-account multi-tenant access, choose accounts in any organizational directory and enter in Dify.
Use the personal Microsoft accounts option only when personal accounts are required, then enter in Dify.
Click .

2. Copy the from the page.
   Copy the too if you chose single tenant.
   Generate a new client secret in the page and copy the value.

3. Configure API permissions.
   Go to the section.
   Add these Microsoft Graph delegated permissions:

• (delegated)
• (delegated)

No application permissions are required.
Grant admin consent if your organization requires it.

4. Install this plugin in Dify and open configuration page.

Fill in the , , and fields.
The value should match your account type choice: your tenant ID or domain, , or .

Copy the from this dialog, then return to the Azure Entra ID page.
Go to the page, select as the platform type, and paste the into the field.
Click .

Now you can go back to the Dify plugin configuration page and click to initiate the OAuth flow.

This plugin will redirect you to the Microsoft login page.
Log in with your Microsoft account and grant the requested delegated permissions.

Then you can use this plugin in a workflow to trigger it when you receive an email.

Monitoring a shared mailbox

The parameter on the subscription accepts a Microsoft Graph mailbox identifier — UPN (), alias, or GUID — so the trigger can watch a shared or departmental mailbox in addition to the signed-in user's personal Inbox. Leave the parameter empty to monitor the personal Inbox (the historical default), or fill in any mailbox your OAuth app has access to.

The existing scope is sufficient for shared-mailbox access; no new permissions are required. Graph returns 403 if your app lacks access to the shared mailbox, and the trigger surfaces that as a normal subscription error.

Microsoft Graph treats as immutable on an existing subscription. To switch a live subscription from personal to shared, unsubscribe and resubscribe.