# Outlook and Microsoft 365 with Pilotiko: your busy times and your outgoing mail

> How Pilotiko connects to Outlook and Microsoft 365: Graph permissions requested, busy-time reading, sendMail, per-employee consent, real status and revoking.

Updated on October 15, 2026 · https://app.pilotiko.com/en/integrations/outlook-microsoft-365

The Outlook / Microsoft 365 connection is designed to read when you're busy, put bookings on your calendar and send confirmations from your Microsoft mailbox. Each employee can also link their own calendar read-only. Status: Being commissioned: the connector is written and tested against a test server; it has not yet been verified with a real account.

## In short
- Business connection: offline_access, Calendars.ReadWrite, Mail.Send and User.Read.
- Employee connection: read-only by default (Calendars.Read); write access is a second, separate consent.
- Co-workers only ever see "busy"; a private event's title is never shown.
- No live Microsoft account has been tried yet, so nothing is read or sent for real today.

## What does the Outlook / Microsoft 365 connection do?

It goes through Microsoft Graph for three things: finding out when you're busy, creating or changing an event, and sending an email from your address. The times Pilotiko offers customers then reflect your actual Outlook calendar.

For the calendar, the connector queries the calendar view over a date range and keeps only blocks shown as busy, out of office or tentative, skipping cancelled events. That's what stops Pilotiko from offering a customer a time that's already taken in Outlook.

To write, it creates the event through Graph's events API [3] with attendees, a UTC start and end, and a description. It can later update or cancel it; an event that's already gone on Microsoft's side isn't treated as an error.

For mail, it calls the sendMail action [2]. Microsoft answers "202 Accepted", and its documentation is explicit that this means the request was accepted, not that processing has finished [2]. Pilotiko records the email as accepted, not delivered. By default, sendMail saves the message to Sent Items [2].

- **Calendars.ReadWrite**: create, read, update and delete events in the user's calendars; as a delegated permission, Microsoft lists it as not requiring admin consent [1].
- **Calendars.Read** (employee connection, default): read events only [1].
- **Mail.Send**: the least-privileged permission sendMail accepts [2].
- **User.Read** identifies the connected account; **offline_access** lets Pilotiko renew access without asking you to sign in again.
- **Needs a person's approval**: a meeting that sends invitations to a customer must be approved, and Pilotiko writes to Outlook only on an explicit action, never as a side effect of syncing.

## How do you connect Outlook or Microsoft 365 to Pilotiko?

1. **Sort out who connects what** — A manager links the business mailbox and calendar once. Each employee can then link their own calendar on their own.
2. **Start the business connection** — In Connections, on the Outlook / Microsoft 365 card, select Connect. Microsoft's sign-in opens with a single-use code that's valid for 10 minutes.
3. **Approve the four permissions** — Microsoft lists calendar read/write, sending mail, your profile and offline access. Approve with the business account.
4. **Link employee calendars** — Each person links their calendar read-only. Only if they want Pilotiko to drop work blocks into it do they grant write access, on a second screen.
5. **Test with a real block** — Block an hour in Outlook, then open Pilotiko's booking page: that hour should no longer be offered.

## What is live, being commissioned or coming soon with Microsoft?

| Feature | Status | Detail |
|---|---|---|
| Reading busy times | Being commissioned | Calendar view over the requested range; tested against a fake Graph server. |
| Create, update, cancel events | Being commissioned | Writes only on an explicit action. |
| Incremental sync of an employee calendar | Being commissioned | Delta queries, change subscriptions and periodic reconciliation, so a lost notice doesn't break anything. |
| Confirmations through sendMail | Being commissioned | No real email goes out yet. |
| Teams meeting attached to an event | Being commissioned | See the Microsoft Teams integration. |
| Reading the inbox | Coming soon | Not built; no mail-read permission is requested. |

Online booking and open-slot calculation are available in Pilotiko without Outlook. The connection adds your Outlook commitments to that calculation.

## What would Pilotiko see in an Outlook calendar over a week?

**Example: a 4-person accounting office during tax season**

Each accountant has 22 Outlook events that week, 3 of them marked private. Pilotiko offers 45-minute appointments between 9 a.m. and 5 p.m.

Sync looks 14 days back and 90 days ahead. Co-workers see "busy" on the 3 private events, with no title.

- Events read per week : 4 × 22 = 88
- Of which private, shown as busy : 4 × 3 = 12
- Open hours per accountant : 8 h × 5 days = 40 h
- Hours already booked (assumption) : 26 h
- 45-minute slots left per accountant : 14 h ÷ 0.75 h = 18
- **= About 18 bookable 45-minute slots per accountant per week, all free in Outlook.**

## What happens to your Microsoft data, and how do you revoke access?

Microsoft tokens are encrypted at rest (AES-256-GCM), refreshed under a lock so two renewals can't collide, and never displayed. If authorization is revoked or expires, the connection flips to "reconnect" rather than failing quietly.

Quebec law requires telling people the purposes of collection, the means used and their right to withdraw consent, and consent must be given for specific purposes [4]. Splitting read and write on an employee's calendar follows that rule: each purpose gets its own yes.

To revoke: Connections → Outlook / Microsoft 365 → Disconnect. Tokens are erased and the action is logged. Then remove Pilotiko from your Microsoft account's app permissions, or ask your Microsoft 365 administrator to. Your rights: [your rights](/en/your-rights).

## What are the Outlook integration's limits?

- Times go to Microsoft in UTC; Outlook shows them in each person's time zone.
- After sendMail, Pilotiko can't look up an interrupted send, so a message whose response was lost stays "uncertain" instead of being resent blindly.
- Pilotiko renews its Graph change subscriptions roughly every 70 hours and reconciles calendars on a schedule in case a notice goes missing.
- Online meetings and transcripts belong to the [Microsoft Teams integration](https://app.pilotiko.com/en/integrations/microsoft-teams). For a Google calendar, see [Google Calendar](https://app.pilotiko.com/en/integrations/google-calendar); to send through Google, see [Gmail](https://app.pilotiko.com/en/integrations/gmail).

## Frequently asked questions

### Does Pilotiko read my Outlook email?

No. The connection requests Mail.Send, which is for sending, and no permission to read mail. Customer replies stay in your Outlook inbox.

### Will co-workers see the details of my personal appointments?

No. By default other members see only "busy". An event marked private in Outlook never reveals its title in Pilotiko.

### Do I need my Microsoft 365 admin's approval?

For Calendars.Read and Calendars.ReadWrite as delegated permissions, Microsoft's permissions reference lists admin consent as not required. If your organization has its own app-approval rules, follow them before linking Pilotiko.

### Can Pilotiko move my Outlook appointments on its own?

No. It writes to Outlook only when a person takes an explicit action, never in reaction to a sync. A meeting that sends invitations to a customer needs approval.

### Is it working yet?

Not with a live account. The connector is being commissioned: written and tested against a test server, it hasn't been verified with a real Microsoft account.

### Will a personal Outlook.com account work?

Microsoft documents Mail.Send as accepted for personal Microsoft accounts on sendMail. Teams transcripts, however, aren't supported for personal accounts, and the connector hasn't been tried with either type yet.

## Sources

1. Microsoft Learn, « Microsoft Graph permissions reference », https://learn.microsoft.com/en-us/graph/permissions-reference (accessed on 2026-10-15)
2. Microsoft Learn, « user: sendMail (Microsoft Graph v1.0) », https://learn.microsoft.com/en-us/graph/api/user-sendmail (accessed on 2026-10-15)
3. Microsoft Learn, « Create event (Microsoft Graph v1.0) », https://learn.microsoft.com/en-us/graph/api/user-post-events (accessed on 2026-10-15)
4. LégisQuébec, « Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) », https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1 (accessed on 2026-10-15)