Skip to main content
On self-hosted OneCLI, Microsoft Word needs your own Microsoft app first. See Self-hosted.

​
Overview

OneCLI connects AI agents to Microsoft Word through Microsoft’s OAuth flow. Agents can read, create, and edit Word documents stored in OneDrive and SharePoint. The gateway injects OAuth credentials into requests to the Microsoft Graph API automatically. This is useful for agents working in Microsoft 365 environments that need to generate reports, draft documents, or process existing Word files.

​
Setup

1

Go to Connections

Open the OneCLI dashboard and navigate to Connections > Microsoft Word.
2

Authorize

Click Connect Microsoft Word. You’ll be redirected to Microsoft to sign in and authorize OneCLI. Review the permissions and click Accept.
OneCLI connect window for Microsoft Word on Cloud, showing the Connect to Microsoft Word button.

The Microsoft Word connect window on OneCLI Cloud.

​
Permissions

​
Self-hosted: use your own Microsoft app

Skip this section on OneCLI Cloud. It’s only for self-hosted OneCLI without MICROSOFT_CLIENT_ID and MICROSOFT_CLIENT_SECRET set. One Microsoft app serves all four Microsoft apps in OneCLI, so you set it up once.

Set up your Microsoft app

Follow Self-hosted: use your own Microsoft app on the Outlook Mail page. If you already have one for another Microsoft app, it already works here. Then open Connections > Microsoft Word and select Connect Microsoft Word.
OneCLI Custom credentials card for Microsoft Word with the setup guide link, the Redirect URI and its copy button, and the Client ID and Client Secret fields.

Custom credentials for Microsoft Word in OneCLI. The Microsoft app is shared, so the same client works here.

​
What agents can do

  • Read the content of Word documents from OneDrive or SharePoint
  • Create new Word documents
  • Edit and update existing documents
  • Search for documents across drives and SharePoint sites
  • Access shared files and followed sites

​
Controlling access

Access is per agent: grant the connection to each agent that needs it, choosing per tool what runs freely, what needs human approval, and what stays blocked — a read-only agent is a single grant. Organization rules add guardrails on top, like rate limits and blanket blocks. Everything is checked before credential injection, so a blocked request never reaches Microsoft Graph.