Microsoft 365 Integration Guide

INTEGRATION GUIDE

Set Up Stackpack’s Microsoft 365 Integration

For Microsoft 365 Global Administrators

Last updated: October 13 2026  •  Setup time: ~5 minutes

Overview

Stackpack’s Microsoft 365 integration automatically identifies and captures vendor contracts, invoices, and receipts from your employees’ Outlook inboxes, eliminating the need for manual uploads or forwarding. Once a Microsoft 365 Global Administrator grants consent, the integration runs entirely in the background with no action required from employees. Only emails determined to contain a relevant vendor document are ever collected; all other email content is immediately discarded.

What This Integration Does

• Automatically scans employee inboxes for vendor contracts, invoices, and receipts.

• Collects only documents identified as relevant vendor contracts, invoices, or receipts. No other email content is retained.

• Matches captured documents to the correct vendor records in Stackpack.

• Greatly reduces the time that employees spend on document discovery.

• Gives admins full control of which users’ mailboxes should be scanned for documents.

• Operates with read-only access: Stackpack cannot send, delete, move, or modify emails.

Prerequisites

Setup Steps

Step 1 — Connect in Stackpack

In the Stackpack admin portal, navigate to:

Company Settings → Agents

Click “Connect Microsoft 365” on the Contract Agent card. Stackpack sends you to Microsoft’s sign-in page.

Step 2 — Grant Consent in Microsoft

Sign in as a Global Administrator of your Microsoft 365 tenant. Microsoft shows a consent page for the application Stackpack Contract Agent requesting one permission:

Click “Accept” to grant consent on behalf of your organization. Microsoft returns you to Stackpack, which confirms that it can read the mailbox of the administrator who connected before saving the connection. If you are not a Global Administrator, Microsoft shows “Need admin approval” instead; ask a Global Administrator to complete this step.

Step 3 — Add Users

In the Stackpack admin portal, navigate to:

Company Settings → Agents

Click “Settings” on the Contract Agent card. Add or remove users that should have their inboxes synced. Use each user’s primary email address in your Microsoft 365 tenant; aliases and shared mailboxes are not supported.

Step 4 — Confirm and Review Settings

Once connected, Stackpack will begin automatically scanning inboxes for vendor contracts, invoices, and receipts. No further action is required to find documents. Each user will be able to review and accept found documents.

How It Works

The integration is entirely automated. Here’s what happens when a new email arrives in a connected inbox:

1. Stackpack periodically queries the inbox through Microsoft Graph for new messages. Junk Email and Deleted Items are skipped.

2. Email headers are retrieved and analyzed to determine if the message is likely to be a vendor contract, invoice, or receipt.

3. If the message is not identified as a relevant vendor document, it is immediately discarded and the body and attachments are never accessed.

4. If the message is likely to contain a vendor contract, invoice, or receipt, the body and attachments are retrieved and processed.

5. The document is matched to the relevant vendor record in Stackpack if possible.

6. The document is then stored in Stackpack alongside the corresponding vendor record if applicable.

Admin Controls

Stackpack gives administrators full control over which inboxes are included in the integration and what types of emails are processed.

Opting Out Users or Departments

Individual employees can be included or excluded from the integration at any time. Navigate to:

Company Settings → Agents

Once a user is included, Stackpack will begin scanning their inbox. Once a user is excluded, Stackpack will never access that user’s inbox.

Limiting Access in Microsoft 365

Consent grants the application permission for your tenant; Stackpack only ever reads the mailboxes of users you add in Stackpack. If your policies also require a limit on the Microsoft side, Exchange Online’s role-based access control for applications can restrict the Stackpack Contract Agent application to specific mailboxes or groups. You will need Stackpack’s Application (client) ID, shown in the Setup Guide in Stackpack and listed below. Stackpack checks each mailbox when it is added, so a mailbox outside your scope is reported at that point rather than failing silently later.

Revoking All Access

To fully disconnect the integration, navigate to the Contract Agent card in Stackpack and click “Disconnect” on the Microsoft 365 connection. To revoke the consent itself, in the Microsoft Entra admin center go to Enterprise applications, open Stackpack Contract Agent, and delete it. Until the consent is revoked, Stackpack retains the ability to reconnect without a new approval.

Employee Experience

Employees only need to take minimal action to benefit from this integration. Vendor contracts, invoices, and receipts are automatically captured and matched in the background. Employees will see their documents already attached to the relevant vendor records in Stackpack. They will need to accept or reject the found documents to let Stackpack know if the document should be committed to the system.

Frequently Asked Questions

Can Stackpack read all emails in my organization?

Consent grants the application permission for your tenant, but Stackpack only processes inboxes for Stackpack users that an administrator of your organization has selected. Users themselves cannot add their own inbox, and are not involved in the process.

Even within those inboxes, the email body is only accessed when the headers indicate the message is likely to contain a vendor contract, invoice, or receipt. Emails not identified as relevant vendor documents have their headers immediately discarded. Stackpack never accesses mailboxes of users who are not active, selected Stackpack users.

Does Stackpack store emails?

Stackpack stores only what is necessary. Email headers are temporarily stored during processing. Email bodies and attachments are only stored if the message is identified as a vendor contract, invoice, or receipt and is successfully matched to a vendor record. The message identifier of processed emails is retained indefinitely to prevent duplicate processing. No other email content is ever stored.

What happens if an employee leaves the company?

When a user’s Stackpack account is deactivated, Stackpack will no longer attempt to access their inbox. Admins can also opt out departing employees proactively through the integration settings before deactivating their account.

Is this integration compliant with our privacy policies?

Stackpack’s Microsoft 365 integration uses Microsoft Graph with an application permission granted by your Global Administrator, and operates with the read-only Mail.Read scope only. For more information about data handling and compliance, refer to the Email Integration Security Brief or contact your Stackpack account manager.

Can I limit which inboxes are included?

Yes. By default, only administrator-selected Stackpack user inboxes are ever accessed. Your tenant can additionally restrict the application to specific mailboxes with Exchange Online role-based access control for applications, described under Admin Controls.

Can we use both Gmail and Microsoft 365?

Yes. Both connections can be active at the same time. Each user is added to the connection that holds their mailbox, and documents from both are matched to the same vendor records.

Why does Stackpack say it could not read a mailbox when adding a user?

Stackpack checks that it can read each mailbox when the user is added. The usual causes are an address that is not the user’s primary address, a user without an Exchange Online mailbox, or a mailbox excluded by your tenant’s role-based access control settings.

Support

If you encounter any issues during setup or have questions about how this integration works, please reach out to Stackpack support: