Table of contents
Microsoft365 Integration Overview
Microsoft 365 is one of two primary entry points into WorkSights, alongside Google Workspace. One tenant-level connection with admin consent covers the organization, bringing Outlook email, Outlook Calendar, Teams calls, Teams chat, OneDrive and SharePoint files, and login activity into the timeline.
Data arrives through two complementary paths. Email, calendar, and Teams calls come through Microsoft Graph in near real time, with full event detail and real durations. Files, Teams chat, and logins come through Microsoft’s audit logs, which are slower and require audit logging to be active for your tenant.
For connection steps, see Connecting Microsoft 365.
What WorkSights Receives
Outlook Email
Sent emails appear with the subject as the title and sender and recipient addresses in the detail. Message bodies and attachments are never received, and drafts are skipped. Received email is kept only when the sender resolves to a known client contact, appearing as client-authored activity on ClientSights; all other inbound mail is dropped. Inbox reads appear as lightweight entries from audit logs.
Outlook Calendar
Event titles, real start and end times, and attendee metadata. Calendar edits, such as creating or updating events, appear as short Calendar Change entries.
Teams Calls
Call records after each call ends, with every participant’s real session duration. Audio, video, transcripts, and meeting content are never received.
Teams Chat
Message-sent events with the chat name, from audit logs. Message text, attachments, and thread history are never received.
OneDrive and SharePoint
File interactions including access, modification, upload, download, rename, move, and deletion, from audit logs. File names and action types are shown; file contents never are.
Login
Sign-in events with timestamps and network metadata, from audit logs. Login is always on and is not feature-gated.
Directory
Users are imported automatically from your tenant, with guests filtered, and stay current through real-time updates and a daily sync.
How Microsoft 365 Activity Appears
Sent emails appear as short scored entries titled with the subject. Emails with an Outlook sensitivity setting other than normal, or an all-caps SENSITIVE, PRIVATE, or CONFIDENTIAL marker in the subject, are set private: masked in the interface and excluded from summaries and AI features.
Calendar events are classified by participants, ignoring rooms and equipment. An event with one or fewer relevant participants who all resolve to WorkSights users is a Meeting (Internal). An event with any external participant is a Meeting (External). Declined attendees keep their RSVP status but are not excluded from this count. Events longer than ten hours are excluded from scoring.
A meeting is written for every mapped attendee with the calendar feature on, plus the mailbox owner, so one meeting legitimately appears on several people’s timelines.
Teams calls appear once per participant, titled with the participant names, each reflecting that person’s real join-to-leave time. Calls appear after they end, not while in progress.
File activity shows the file name and action. Teams chat and login events appear as short entries.
Timing
Email, calendar, and call activity appears within roughly 20 minutes. File, chat, and login activity comes through Microsoft’s audit pipeline and lags hours rather than minutes. This difference is by design on Microsoft’s side.
Audit Log Dependency
Files, Teams chat, and login activity require the Unified Audit Log to be active for your tenant. Without it, these signals will not appear at all. Email, calendar, and Teams calls work regardless. Microsoft describes auditing as on by default, but in practice it frequently is not. If these signals are missing, see Microsoft 365 Audit Log Activation.
Integration Page Overview
The Microsoft 365 integration page contains four tabs:
- Overview - Connection details and integration owner
- Users - Directory users mapped to WorkSights users
- Features - Controls for Outlook Email, Outlook Calendar, Teams Calls, Teams Chat, and OneDrive
- Connections - Connected Microsoft 365 tenants
WorkSights supports multiple tenants. To connect more than one, use the Add Additional option in Services after the first connection is complete.
Data Notes
WorkSights receives metadata and headers only. Message bodies, file contents, chat text, audio, video, recordings, and transcripts are never received or stored. All permissions are read-only, and access can be revoked at any time in the Microsoft 365 Admin Center under Enterprise Applications.
Troubleshooting
Connection fails during setup
The admin consent flow requires a Microsoft 365 tenant admin. Reconnect with an admin account.
No file, chat, or login activity at all
Tenant auditing is likely disabled. Have the tenant admin enable auditing in Microsoft Purview. This is common: auditing is described as on by default but frequently is not in practice. See Microsoft 365 Audit Log Activation.
Email and meetings stopped for everyone at once
The connection token may be broken, for example if admin consent was revoked. Reconnect to re-consent. If the outage lasted more than a day, contact success@worksights.ai to run a backfill for the gap.
One user has calendar activity but no email
The user likely has no Exchange Online license or mailbox. This is expected: mailbox-less users are skipped for email and rechecked automatically each cycle.
Everything from one user shows time-shifted entries
Microsoft does not supply user timezones, so users default to UTC. Set the user’s timezone manually in WorkSights, or connect Google Workspace or Slack, which supply one.
A meetings is categorized Internal but included a client, or the reverse
Categorization requires every attendee to resolve to a WorkSights user for Internal. Check the attendee list and user mappings.
Activity appears late
Email, calendar, and call activity processes within roughly 20 minutes. File, chat, and login activity lags hours because of Microsoft’s audit pipeline. Both are expected.