Microsoft Graph V2

Microsoft Graph is the single endpoint for all Microsoft 365 data — one API to access Outlook mail, Calendar, Teams, OneDrive, SharePoint, and Azure AD, avoiding separate API integrations per service. For agents: application permissions (no user sign-in required) are the recommended pattern for server-side agents — register an app in Entra ID, grant application permissions (Mail.Read, Calendars.ReadWrite, etc.), and use client credentials flow. Breadth is massive: send emails, create meetings, post Teams messages, manage OneDrive files, and query org directory. Microsoft Graph SDK handles token refresh automatically. Confidence is docs-derived.

REST API at graph.microsoft.com/v1.0. Resources: /me, /users/{id}, /messages, /events, /chats, /teams, /drives, /sites, /groups. GET /users/{id}/messages lists Outlook emails. POST /users/{id}/sendMail sends an email ({message: {subject, body, toRecipients}}). GET /users/{id}/events lists calendar events. POST /users/{id}/events creates a calendar event. GET /users/{id}/chats lists Teams chats. POST /chats/{id}/messages sends a Teams message. GET /users/{id}/drive/root/children lists OneDrive root files. GET /users lists all users in tenant. PATCH /users/{id} updates user properties. Graph SDK (Python): GraphServiceClient(credential, scopes) — fluent builder API for all resources. Delta queries: GET /users/delta for incremental change tracking.

OAuth2: Microsoft identity platform (Entra ID). Application permissions (recommended for agents): POST /oauth2/v2.0/token with client_credentials grant ({client_id, client_secret, scope: https://graph.microsoft.com/.default}). Register app in Azure Portal → App Registrations → grant Application Permissions. Token: Bearer {access_token}. HTTPS enforced. Managed Identity: supported when running in Azure (no stored credentials). Permission scopes: granular per resource (Mail.Read, Mail.Send, Calendars.ReadWrite, Files.ReadWrite.All, etc.). Tenant admin consent required for application permissions.

Standard HTTP status codes with OData JSON error bodies ({error: {code, message, innerError}}). 403 for missing permission (check granted application permissions). 429 for throttling (Retry-After header in response). Token expiry: 1 hour — SDK handles refresh automatically. Delta tokens: expire after 30 days if not used. Eventual consistency: directory changes (user creation) may take 1-2 minutes to appear. Microsoft Graph uptime at admin.microsoft.com/servicestatus. Throttling: per-app, per-user, and per-tenant limits — implement exponential backoff. Large file upload: use upload sessions (resumable) for OneDrive files > 4MB.

learn.microsoft.com/graph is comprehensive — API reference, authentication guide, SDK documentation, permissions reference, and quickstart tutorials. Getting started: Azure free account, register app in Entra ID, grant permissions, get access token, first API call in under 15 minutes. Microsoft Graph SDK: pip install msgraph-sdk. Graph Explorer (developer.microsoft.com/graph/graph-explorer) for interactive testing. Community via Microsoft Q&A (azure-active-directory tag) and Microsoft Tech Community. Enterprise-grade documentation with detailed examples for all 365 services.