Build a Mailbox-Scoped Microsoft Outlook Connector for Amazon Quick Automate Using Service Authentication and MS Exchange RBAC

Learn how to configure the Microsoft Outlook action connector for Amazon Quick Automate using service-to-service (app-only) authentication, and scope app access to specific mailboxes using Microsoft Exchange Online RBAC application access policies. This approach enforces the principle of least privilege — ensuring your automation can only interact with the mailboxes it needs.

Vinod Jaganathan

Sr Gen AI Architect , Amazon Quick

Published May 19, 2026

Last modified May 19, 2026

Organizations building email-driven automations with Amazon Quick Automate often need to read, send, or manage calendar events without requiring interactive user sign-in. The built-in Microsoft Outlook connector in Amazon Quick supports service-to-service authentication using the OAuth 2.0 Client Credentials flow, enabling fully unattended automation workflows.

However, by default, application-level permissions in Microsoft Graph grant access to all mailboxes in the tenant. This creates a security concern for production deployments — an automation designed to monitor a shared mailbox should not have access to every employee's inbox.

Microsoft Exchange Online solves this through RBAC for Applications, which restricts an application's access to a specific set of mailboxes using service principals, management scopes, and role assignments. In this post, we walk through the end-to-end configuration: from app registration in Microsoft Entra ID, to Exchange RBAC scoping, to setting up the Outlook connector in Amazon Quick Automate.

Solution Overview

This solution combines three key components to achieve secure, scoped mailbox automation:

An app registration in Microsoft Entra ID (with no API permissions assigned)
Exchange Online RBAC role assignments that grant specific mail permissions scoped to specific mailboxes
The Amazon Quick Outlook connector configured with service-to-service OAuth to authenticate as the registered application

The following diagram illustrates the architecture:

1
Amazon Quick Automate → Outlook Connector (Service Auth) → Microsoft Graph API → Exchange Online (Scoped via RBAC Application Access Policy)

Component	Role
Amazon Quick Automate	Orchestrates the workflow (triggers, actions, conditions)
Outlook Connector	Built-in connector using OAuth 2.0 Client Credentials
Microsoft Entra ID	Issues tokens for the registered application
Exchange Online RBAC	Restricts the app to specific mailboxes via service principal, management scope, and role assignments
Microsoft Graph API	API layer for mail, calendar, and contacts

What This Enables

✅ Read emails from scoped mailboxes
✅ Send emails on behalf of scoped mailboxes
✅ Access calendar events for scoped mailboxes
✅ Fully unattended (no user interaction required)
❌ Access to mailboxes outside the management scope (blocked by RBAC)

Prerequisites

To follow along with this post, you need:

An Amazon Quick subscription with access to Automate
A Microsoft Entra ID (Azure AD) tenant with Application Administrator or Global Administrator role
Exchange Online with Exchange Administrator role (for RBAC policy configuration)
Target mailbox(es) identified for the automation
PowerShell with the ExchangeOnlineManagement module installed (see below)

Installing PowerShell and ExchangeOnlineManagement Module

macOS

Install PowerShell on macOS using Homebrew. For detailed instructions, see Install PowerShell on macOS .

1
2
3
4
5
# Install PowerShell
brew install powershell/tap/powershell

# Launch PowerShell
pwsh

Windows

PowerShell 5.1 is already built into Windows. For PowerShell 7+ (recommended), see Install PowerShell on Windows .

1
2
# Install PowerShell 7+ via winget
winget install --id Microsoft.PowerShell --source winget

Exchange Online Module (both platforms)

Install the ExchangeOnlineManagement module to manage Exchange Online via PowerShell. For detailed instructions, see About the Exchange Online PowerShell module .

1
2
3
4
5
# Install the module
Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser

# Verify installation
Get-Module -Name ExchangeOnlineManagement -ListAvailable

Step 1: Register the App in Microsoft Entra ID

Step 1.1: Create the App Registration

Navigate to the Microsoft Entra admin center
In the left navigation, go to Entra ID → App registrations
Click New registration
Fill in the registration form:
- Name: Enter a descriptive name (e.g., Amazon-Quick-Automate-Srv-Srv-Outlook-App)
- Supported account types: Select "Single tenant only" (accounts in this organizational directory only)
- Redirect URI : Select Web and enter Amazon Quick callback URL (e.g., https://us-east-1.quicksight.aws.amazon.com/sn/oauthcallback)
Click Register

No API Permissions Required

Important: You do not need to add any Microsoft Graph API permissions (such as Mail.Read, Mail.Send, or Calendars.ReadWrite) at the application registration level. The application itself has zero permissions assigned in Entra ID. All mailbox access permissions are granted exclusively through Exchange Online RBAC role assignments configured in Step 2, providing a cleaner separation of concerns and more granular control.

Step 1.2: Generate a Client Secret

From your app registration, go to Certificates & secrets in the left menu
Under the Client secrets tab, click + New client secret
Enter a description (e.g., Amazon-Quick-Automate-Srv-Srv-Outlook-App)
Set an expiration (e.g., Recommended: 180 days / 6 months)
Click Add
Copy the Value immediately — it won't be shown again

Step 1.3: Note the Required IDs

You will need the following three values for the subsequent configuration steps:

Application (client) ID and Directory (tenant) ID — Found on the App registrations → your app → Overview page

Object ID (of the Enterprise Application / Service Principal) — Navigate to Entra ID → Enterprise apps → find your app → Overview page. This is the Object ID you will use when creating the service principal in Exchange Online (Step 2.1).

Important: The Object ID on the Enterprise Application page is different from the Object ID on the App Registration page. For the Exchange RBAC configuration, you need the Enterprise Application Object ID.

Value	Where to Find
Application (client) ID	App registrations → Overview
Directory (tenant) ID	App registrations → Overview
Object ID (Enterprise App)	Enterprise apps → Overview
Client secret value	App registrations → Certificates & secrets

Step 2: Configure MS Exchange RBAC for Applications

This is the critical step that scopes the application to specific mailboxes only. You use RBAC for Applications in Exchange Online to grant fine-grained mailbox access to the registered application.

How RBAC for Applications Works

RBAC (Role-Based Access Control) for Applications in Exchange Online uses a role assignment model with three components:

Application (Service Principal) — The registered app that needs access (e.g., Amazon Quick Automate - Outlook)
Application Role — The specific permission being granted (e.g., Application Mail.Read, Application Mail.Send)
Resource Scope (Management Scope) — The set of mailboxes the app is allowed to access, defined by a recipient restriction filter (e.g., QuickAutomate-AllowedMailboxes)

A Role Assignment ties all three together: it grants a specific role to a specific application, scoped to a specific set of mailboxes. Each permission requires its own role assignment, allowing you to grant different levels of access independently.

For example, to grant your Amazon Quick Automate application both read and send access to a set of mailboxes, you create two role assignments — one for Application Mail.Read and one for Application Mail.Send — both scoped to the same management scope (QuickAutomate-AllowedMailboxes).

The following sub-steps walk through the complete configuration process.

Note: As of writing this article, there is no REST API (GRAPH API) available for configuring RBAC for Applications in Exchange Online. The Exchange Online Admin API (currently in preview) covers only a limited set of scenarios (organization config, group membership, folder permissions, and delegation) and does not support RBAC management operations. All service principal creation, management scope definition, and role assignment operations must be performed via PowerShell using the ExchangeOnlineManagement module .

Connect to Exchange Online via PowerShell

First, attempt to connect using your admin UPN:

1
2
pwsh
Connect-ExchangeOnline -UserPrincipalName admin@yourtenant.onmicrosoft.com

If the connection fails with a System.PlatformNotSupportedException error (common on macOS or environments without a browser), use the device login flow instead:

1
Connect-ExchangeOnline -Device

This will display a URL (https://login.microsoft.com/device) and a one-time code. Open the URL in a browser, sign in with your Microsoft admin account, and enter the code to authorize the PowerShell session.

In the browser, you will be prompted to authorize the session for Microsoft Exchange REST API Based Powershell. Click Continue to complete the authentication.

Once connected, verify the connection by retrieving your organization details (Optional) :

1
Get-OrganizationConfig | Select-Object DisplayName, Name, Guid

Step 2.1: Create a Service Principal in Exchange

1
2
3
4
New-ServicePrincipal `
    -AppId <APP-ID> `
    -ObjectId <OBJECT-ID> `
    -DisplayName "Amazon Quick Automate - Outlook"

Note: The ObjectId is the Object ID of the Enterprise Application (Service Principal) in Entra ID — not the App Registration Object ID.

Step 2.2: Create a Management Scope (Mailbox Restriction)

Define which mailboxes the application is allowed to access using a recipient restriction filter:

1
2
3
New-ManagementScope `
    -Name "QuickAutomate-AllowedMailboxes" `
    -RecipientRestrictionFilter "PrimarySmtpAddress -in {'mailbox1@yourtenant.com','mailbox2@yourtenant.com'}"

This scope restricts access to only the mailboxes listed in the filter. You can adjust the filter to use other attributes (e.g., department, custom attributes) for dynamic scoping.

Step 2.3: Assign Roles to the Application

Assign the specific mail roles your automation needs, scoped to the management scope created above:

1
2
3
4
5
6
7
8
9
10
11
12
13
# Grant Mail.Read access
New-ManagementRoleAssignment `
    -Name "QuickAutomate-Mail-Read" `
    -Role "Application Mail.Read" `
    -App <APP-ID> `
    -CustomResourceScope "QuickAutomate-AllowedMailboxes"

# Grant Mail.Send access
New-ManagementRoleAssignment `
    -Name "QuickAutomate-Mail-Send" `
    -Role "Application Mail.Send" `
    -App <APP-ID> `
    -CustomResourceScope "QuickAutomate-AllowedMailboxes"

Note: Only assign the roles your automation actually requires. Available application roles include Application Mail.Read, Application Mail.Send, Application Calendars.Read, Application Calendars.ReadWrite, and others. See the full list of application RBAC roles .

Verify the Configuration

After completing the role assignments, verify that the application has the correct permissions by listing all role assignments for the service principal:

1
2
# List role assignments for the application
Get-ManagementRoleAssignment -RoleAssignee <OBJECT-ID>

This should return the role assignments you created (e.g., QuickAutomate-Mail-Read and QuickAutomate-Mail-Send), each showing the associated role and custom resource scope. If the output is empty or missing an expected assignment, re-run the corresponding New-ManagementRoleAssignment command from Step 2.3.

Note: Any changes to RBAC permissions (new role assignments, scope modifications, or removals) can take approximately 30 minutes to take effect. If your connector returns permission errors immediately after configuration, wait and retry. For more details, see RBAC for Applications in Exchange Online .

Step 3: Configure the Outlook Connector in Amazon Quick

With the Exchange RBAC configuration in place, you can now configure the Microsoft Outlook action connector in Amazon Quick.

In the Amazon Quick console, navigate to Connectors in the left panel
Click Add Connector and select Microsoft Outlook
Fill in the Microsoft Outlook connection details:

Field	Value
Name	A descriptive name for your connector (e.g., `Outlook-RBAC-SRV-SRV`)
Connection type	Public network
OAuth Configuration	Service-to-Service OAuth
Base URL (Optional)	`https://graph.microsoft.com/v1.0`
Client ID	The Application (client) ID from Step 1
Client secret	The client secret value from Step 1
Token URL	`https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/token`

Note: The Token URL must include your specific tenant ID. Replace TENANT-ID with the Directory (tenant) ID noted in Step 1. Format: https://login.microsoftonline.com/{YOUR-TENANT-ID}/oauth2/v2.0/token

Click Next to proceed through the Review step
Complete the setup by clicking Publish

Important: Since this is a service-to-service integration, the connector cannot be tested through chat agents using the "Try it" button. To verify the connector works correctly, test it within an Automation project using debug mode.

Step 4: Test the Connector in an Automation Project

To verify the connector is working correctly with the RBAC-scoped mailbox access, you need to create an Automation project and test it in debug mode.

Step 4.1: Create an Automation Group

In the Amazon Quick console, navigate to Automations in the left panel
Create a new Automation Group
Add the newly created Outlook service-to-service action connector to the group

Step 4.2: Create an Automation Project

Within the Automation Group, create a new Automation project
In the project editor, add an action step: List user mails
Configure the action with the following parameters:

Parameter	Value
Action title	List user mails
Connection	Your Outlook SRV-SRV connector
User id	The email address of a mailbox within the management scope
Folder	`'Inbox'`
Top	`2` (limit results for testing)
Skip	`0`

Step 4.3: Run in Debug Mode

Click the Debug button in the top-right corner of the Automation project editor
Run the automation and check the Test panel on the right
If the RBAC configuration is correct, the action will complete successfully and the logs will show the Microsoft Graph API response containing email messages from the scoped mailbox

Verify Scoped Access

✅ Test with a mailbox inside the management scope → action completes successfully, emails are returned
❌ Test with a mailbox outside the management scope → action fails with 403 Forbidden

This confirms the RBAC policy is correctly enforced and the connector only has access to the mailboxes defined in your management scope.

Real-World Use Case: Legal Response Assistant

With the scoped Outlook connector configured, you can build sophisticated automations that go beyond simple email forwarding. For example, the Amazon Quick Automate as a Legal Response Assistant article demonstrates a workflow that:

Monitors a shared legal team inbox using the List user mails action (same action you tested above)
Detects legal inquiries using conditional logic on the email subject
Generates AI-powered answers using a Custom Agent backed by Amazon Bedrock
Sends professionally formatted HTML email replies using the Send User Email action

This pattern uses the same service-to-service Outlook connector and RBAC scoping described in this article — ensuring the automation only has access to the designated legal mailbox while delivering fully automated, intelligent email responses.

Conclusion

By combining the Amazon Quick Automate Outlook connector's service authentication with Microsoft Exchange Online RBAC application access policies, you can build fully automated email workflows that adhere to the principle of least privilege. The application can only access the specific mailboxes defined in your management scope — providing both the automation benefits of app-only authentication and the security controls your organization requires.

References

# agentic-ai # amazon-quick-suite # microsoft

Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.

Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article

Builder Center

Build a Mailbox-Scoped Microsoft Outlook Connector for Amazon Quick Automate Using Service Authentication and MS Exchange RBAC

Vinod Jaganathan

Solution Overview

What This Enables

Prerequisites

Installing PowerShell and ExchangeOnlineManagement Module

macOS

Windows

Exchange Online Module (both platforms)

Step 1: Register the App in Microsoft Entra ID

Step 1.1: Create the App Registration

No API Permissions Required

Step 1.2: Generate a Client Secret

Step 1.3: Note the Required IDs

Step 2: Configure MS Exchange RBAC for Applications

How RBAC for Applications Works

Connect to Exchange Online via PowerShell

Step 2.1: Create a Service Principal in Exchange

Step 2.2: Create a Management Scope (Mailbox Restriction)

Step 2.3: Assign Roles to the Application

Verify the Configuration

Step 3: Configure the Outlook Connector in Amazon Quick

Step 4: Test the Connector in an Automation Project

Step 4.1: Create an Automation Group

Step 4.2: Create an Automation Project

Step 4.3: Run in Debug Mode

Verify Scoped Access

Real-World Use Case: Legal Response Assistant

Conclusion

References