Microsoft To Do

MICROSOFT 365 · TASKS

Task lists kept in Microsoft To Do, scoped to that person.

Connect Microsoft To Do with Fabriq Developer

Your user consents at Microsoft To Do. The credential lands in a vault your agent cannot read, and the tool list it gets back is the intersection of that user’s grant and the agent’s own scopes.

provider “microsoft_todo”

from af_sdk import AgenticFabriq

af = AgenticFabriq()                      # reads AF_APP_ID / AF_APP_SECRET

url = await af.initiate_connection(request, provider="microsoft_todo")   # consent at Microsoft To Do
return redirect(url)

async with await af.for_user(request) as session:
    tools = await session.get_tools()     # only what this user granted

Provider names are surfaces, not vendors, and the authoritative list is the capabilities endpoint rather than any page including this one — an unknown name returns 400 with the valid list. Fabriq Developer is free to start and needs no provider paperwork. Start free or read the quickstart.

Connecting Microsoft To Do in practice

Microsoft To Do has no application permission for creating a task: POST to a task list is marked "Not supported" for app-only in both the /me and /users forms, while listing tasks and updating someone else’s task do have app-only routes. An unattended agent can therefore read and edit a person’s tasks but cannot add one, and its webhooks expire after at most 4,230 minutes, under three days.

Scopes that draw scrutiny

Tasks.ReadWrite Delegated only, no admin consent, available on personal Microsoft accounts, and the only permission that can create a task. It covers the signed-in user’s tasks and task lists "including any shared with the user".
Tasks.Read.All Application only and admin consent required: "Read all users’ tasks and task lists in your organization, without a signed-in user."
Tasks.ReadWrite.All Application only and admin consent required. The app-only grant for editing anyone’s tasks, and still not enough to create one.
Tasks.ReadWrite.Shared Delegated only and no admin consent, but it extends to tasks shared with the user rather than only their own — more reach than it looks, approved by the user alone.

Rate limits

Microsoft’s throttling page files the To-do tasks API under the Outlook service, whose per-mailbox limits are 10,000 requests per 10 minutes and four concurrent requests per app ID and mailbox.
The resources that table actually names are the legacy outlookTask, outlookTaskFolder and outlookTaskGroup types, so no figure is published specifically for the current todoTask surface.
Change-notification subscriptions on todoTask expire after a maximum of 4,230 minutes (under three days).
Microsoft Graph global limit: 130,000 requests per 10 seconds per app across all tenants.

Who has to approve

Tasks.Read.All and Tasks.ReadWrite.All exist only as application permissions and both require tenant admin consent, so any unattended access to another person’s tasks needs an administrator. The delegated Tasks.Read and Tasks.ReadWrite do not, and both are available on personal Microsoft accounts.

Worth knowing

Creating a task is delegated-only, so a daemon cannot file a task on a user’s behalf — it has to hold a user token, which means refresh-token lifecycle rather than client credentials.
A task’s id changes when the task is moved from one list to another, so ids are not durable keys across lists.
Change notifications are scoped to one task list (/me/todo/lists/{todoTaskListId}/tasks), so watching a whole account means one subscription per list, each renewed inside three days.
todoTask webhooks are documented as available only in the global endpoint and not in the national clouds, and the To Do task endpoints are unavailable in the China cloud operated by 21Vianet, so those tenants get neither.

Checked against Create todoTask (permissions table) (2026-09-29), List todoTasks (permissions table) (2026-09-29), Microsoft Graph permissions reference (2026-09-29), Change notifications: supported resources and expiration (2026-09-29)

Acts as the person, not as itself

Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.

Credentials never touch the agent

Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.

Every call on the record

Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.

What an agent can do

Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.

microsoft_todo_add_task_attachmentWRITE

Attach a file (max 3 MB, base64-encoded) to a To-Do task.

Tasks.ReadWrite

microsoft_todo_add_task_checklist_itemWRITE

Add a checklist item (sub-task) to a To-Do task.

Tasks.ReadWrite

microsoft_todo_complete_taskWRITE

Mark a To-Do task as completed.

Tasks.ReadWrite

microsoft_todo_create_shared_taskWRITE

Create a task in a shared To-Do list. Requires Tasks.ReadWrite.Shared (grants write access to task lists shared by other users).

Tasks.ReadWrite.Shared

microsoft_todo_create_taskWRITE

Create a new task in a Microsoft To-Do list.

Tasks.ReadWrite

microsoft_todo_create_task_listWRITE

Create a new Microsoft To-Do task list.

Tasks.ReadWrite

microsoft_todo_delete_shared_taskWRITE

Delete a task from a shared To-Do list. Requires Tasks.ReadWrite.Shared (grants delete access to tasks in lists shared by other users).

Tasks.ReadWrite.Shared

microsoft_todo_delete_taskWRITE

Delete a task from a Microsoft To-Do list.

Tasks.ReadWrite

microsoft_todo_delete_task_attachmentWRITE

Delete an attachment from a To-Do task.

Tasks.ReadWrite

microsoft_todo_delete_task_checklist_itemWRITE

Delete a checklist item from a To-Do task.

Tasks.ReadWrite

microsoft_todo_delete_task_listWRITE

Delete a Microsoft To-Do task list and all tasks within it.

Tasks.ReadWrite

microsoft_todo_get_taskREAD

Get a specific To-Do task.

Tasks.Read

microsoft_todo_list_shared_task_listsREAD

List To-Do task lists shared with the user by others. Requires Tasks.Read.Shared (grants access to task lists that others have explicitly shared with this user).

Tasks.Read.Shared

microsoft_todo_list_shared_tasksREAD

List tasks in a shared To-Do list. Requires Tasks.Read.Shared (grants read access to tasks in lists shared by other users).

Tasks.Read.Shared

microsoft_todo_list_task_attachmentsREAD

List all attachments on a To-Do task.

Tasks.Read

microsoft_todo_list_task_listsREAD

List the user's Microsoft To-Do task lists.

Tasks.Read

microsoft_todo_list_tasksREAD

List tasks in a Microsoft To-Do list.