Microsoft Contacts

MICROSOFT 365 · PEOPLE

Read and maintain contacts held in their Microsoft 365 account.

Connect Microsoft Contacts with Fabriq Developer

Your user consents at Microsoft Contacts. The credential lands in a vault your agent cannot read, and the tool list it gets back is the intersection of that user’s grant and the agent’s own scopes.

provider “microsoft_contacts”

from af_sdk import AgenticFabriq

af = AgenticFabriq()                      # reads AF_APP_ID / AF_APP_SECRET

url = await af.initiate_connection(request, provider="microsoft_contacts")   # consent at Microsoft Contacts
return redirect(url)

async with await af.for_user(request) as session:
    tools = await session.get_tools()     # only what this user granted

Provider names are surfaces, not vendors, and the authoritative list is the capabilities endpoint rather than any page including this one — an unknown name returns 400 with the valid list. Fabriq Developer is free to start and needs no provider paperwork. Start free or read the quickstart.

Connecting Microsoft Contacts in practice

A contact’s id changes the moment the item is moved to another folder unless every request carries the Prefer: IdType="ImmutableId" header, so a stored contact id is not a durable key by default. The same scope name also means two different grants: delegated Contacts.Read is the signed-in user’s contacts, while the application form is "Read contacts in all mailboxes" across the whole tenant.

Scopes that draw scrutiny

Contacts.Read Delegated it needs no admin consent; as an application permission it reads all contacts in all mailboxes and does require admin consent. One name, two blast radii.
Contacts.ReadWrite Same split. The application form can "create, read, update, and delete all contacts in all mailboxes without a signed-in user".
Contacts.Read.Shared Delegated only and no admin consent, but it reaches contacts a user has permission to access rather than just their own — a wider grant a user can approve alone.
Contacts.ReadWrite.Shared The write form of the same thing: create, read, update and delete contacts shared with the user, again with no admin consent.

Rate limits

Contacts is an Outlook service API, so the limits are per app ID and mailbox: 10,000 requests in a 10-minute period and four concurrent requests, on both v1.0 and beta.
150 MB of upload (PATCH, POST, PUT) in a 5-minute period per app and mailbox.
A maximum of 1,000 active contact change-notification subscriptions per mailbox for all applications combined.
Subscriptions on contact expire after at most 10,080 minutes (under seven days), or 1,440 minutes for subscriptions that carry resource data.
Microsoft Graph global limit: 130,000 requests per 10 seconds per app across all tenants.

Who has to approve

The application forms of Contacts.Read and Contacts.ReadWrite require tenant admin consent; the delegated forms do not. An admin can also configure an application access policy so an app holding tenant-wide Contacts permissions only reaches specific mailboxes.

Worth knowing

displayName is quietly overwritten: Microsoft warns that "later updates to other properties may cause an automatically generated value to overwrite the displayName value you have specified", so every update has to resend displayName to preserve it.
Graph’s contact resource is Outlook personal contacts only. The organization’s directory is the user and person resources, a different API with different permissions, so "look up this person" and "read my contacts" are two integrations.
Delta query is scoped to a specified folder, so keeping a mailbox in sync means one delta chain per contact folder rather than one per user.
Delete moves a contact to recoverable items; only the separate permanentDelete action purges it, which matters for a right-to-erasure workflow.

Checked against contact resource type (2026-09-29), Microsoft Graph throttling limits — Outlook service (2026-09-29), Microsoft Graph permissions reference (2026-09-29), Change notifications: supported resources and expiration (2026-09-29)

Acts as the person, not as itself

Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.

Credentials never touch the agent

Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.

Every call on the record

Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.

What an agent can do

Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.

microsoft_contacts_create_contactWRITE

Create a new contact.

Contacts.ReadWrite

microsoft_contacts_create_contact_folderWRITE

Create a new contact folder. Requires Contacts.ReadWrite.

Contacts.ReadWrite

microsoft_contacts_create_shared_contactWRITE

Create a contact in another user's shared mailbox. Requires Contacts.ReadWrite.Shared.

Contacts.ReadWrite.Shared

microsoft_contacts_delete_contactWRITE

DESTRUCTIVE. Permanently deletes a contact from the mailbox. Microsoft Graph publishes no undelete for contacts and no recycle bin they land in, so the name, addresses, phone numbers and notes on the record are gone and Agentic Fabriq cannot restore them. There is no inverse action; recreating the person with microsoft_contacts_create_contact makes a NEW record, which does not recover anything the old one held.

Contacts.ReadWrite

microsoft_contacts_delete_contact_folderWRITE

Delete a contact folder and all its contacts. Requires Contacts.ReadWrite.

Contacts.ReadWrite

microsoft_contacts_delete_shared_contactWRITE

Delete a contact from another user's shared mailbox. Requires Contacts.ReadWrite.Shared.

Contacts.ReadWrite.Shared

microsoft_contacts_get_contactREAD

Get a specific contact by ID.

Contacts.Read

microsoft_contacts_get_shared_contactREAD

Get a specific contact from another user's shared mailbox. Requires Contacts.Read.Shared.