Microsoft Planner

Microsoft Planner

This connector works with Microsoft Planner through Microsoft Graph v1.0 (https://graph.microsoft.com/v1.0, /planner, /me/planner): the user's tasks across plans, the plans of their Microsoft 365 groups and teams, buckets, tasks with assignees, dates, priority, progress and labels, and task details (description, checklist, links). Planner needs a work or school account; personal Microsoft accounts have no Planner. Everything runs as the user who authorized the connector and sees only plans of groups the user belongs to.

Setup (one-time, about 10 minutes)

1. Open https://entra.microsoft.com (or https://portal.azure.com) → Applications → App registrations → New registration.
2. Name it (e.g. "AnythingMCP Microsoft 365") and choose the supported account types:
   • Accounts in this organizational directory only (single tenant): only your organisation's users can sign in. Set MICROSOFT_TENANT_ID to the Directory (tenant) ID shown on the app's Overview page (a GUID), or to your domain such as contoso.onmicrosoft.com.
   • Accounts in any organizational directory (multi-tenant): set MICROSOFT_TENANT_ID to organizations.
   • ... and personal Microsoft accounts: not for this connector: Planner does not support personal Microsoft accounts, so consumers does not work. With common only work or school accounts can use it. The value must match the app's account type, otherwise Microsoft refuses the sign-in (AADSTS50194 or AADSTS50020).
3. Under Redirect URI pick platform Web and enter https://cloud.anythingmcp.com/api/mcp-oauth/callback on AnythingMCP Cloud, or <your AnythingMCP URL>/api/mcp-oauth/callback when you host AnythingMCP yourself. It must match character for character (AADSTS50011 otherwise).
4. API permissions → Add a permission → Microsoft Graph → Delegated permissions: add offline_access, User.Read, Tasks.ReadWrite.
5. Certificates & secrets → New client secret. Copy the secret Value (not the Secret ID); it is shown once. Note its expiry date: when it expires the connector stops working until you paste a new one.
6. Paste the Application (client) ID into MICROSOFT_CLIENT_ID, the secret value into MICROSOFT_CLIENT_SECRET, the tenant value from step 2 into MICROSOFT_TENANT_ID, and install.
7. On the connector page click Authorize with Provider and sign in with the work or school account whose plans the AI should work with. The refresh token is stored encrypted and access tokens (about 1 hour) are renewed automatically.

One Entra app for all Microsoft connectors: the app registration made for the Outlook connector works here as well. Open it, add the delegated permissions from step 4 under API permissions, keep the same redirect URI, and reuse the same MICROSOFT_CLIENT_ID, MICROSOFT_CLIENT_SECRET and MICROSOFT_TENANT_ID. Each connector asks only for its own scopes when you authorize it. The permissions per connector:

• Outlook: Mail.ReadWrite, Mail.Send, Calendars.ReadWrite
• OneDrive: Files.ReadWrite
• Excel: Files.ReadWrite (plus Files.ReadWrite.All for workbooks in SharePoint or shared with the user)
• SharePoint: Sites.ReadWrite.All and Files.ReadWrite.All
• OneNote: Notes.ReadWrite
• Microsoft To Do: Tasks.ReadWrite
• Planner: Tasks.ReadWrite Every connector also needs offline_access and User.Read.

Admin consent: these delegated permissions normally do not need an administrator, but many organisations turn off user consent. If the sign-in shows "Need admin approval" (AADSTS65001 or AADSTS90094), a tenant administrator opens the app registration → API permissions → Grant admin consent for <organisation> once; afterwards every user can authorize. Each connector still works only with what the account that signed in may see.

Scopes: offline_access User.Read Tasks.ReadWrite. offline_access is what makes Microsoft issue a refresh token; without it the connector stops an hour after authorizing. Tasks.ReadWrite is all Planner needs for delegated access and needs no admin consent by itself; Group.Read.All or Group.ReadWrite.All also work but need an administrator, so they are not asked for. User.Read also covers microsoft_planner_list_my_groups. The Microsoft To Do connector uses the same Tasks.ReadWrite permission. For a read-only setup, use offline_access User.Read Tasks.Read, authorize again, and disable microsoft_planner_create_task, microsoft_planner_update_task, microsoft_planner_update_task_details and microsoft_planner_create_bucket.

Confirm writes: before creating, changing or moving a task or bucket, tell the user what you are about to do and wait for a yes. Plans are shared: a change is visible to everyone in the group.

Switched off at install: microsoft_planner_delete_task. Turn it on only if the AI should delete tasks; deleting removes the task for the whole team.

Finding things: microsoft_planner_list_my_tasks gives the tasks assigned to the user across all plans. microsoft_planner_list_my_plans lists plans shared with the user; for a team's plan, find the group with microsoft_planner_list_my_groups (groupTypes contains Unified) and call microsoft_planner_list_group_plans. A plan holds buckets (microsoft_planner_list_buckets) and tasks (microsoft_planner_list_plan_tasks, microsoft_planner_list_bucket_tasks). Label names (category1 ... category25) are in microsoft_planner_get_plan_details.

Progress and priority: percentComplete 0 is not started, 50 in progress, 100 completed; open tasks are the ones below 100. priority 1 is Urgent, 3 Important, 5 Medium, 9 Low (0-10, lower is more urgent).

Changing a task (etag): Planner only accepts a change together with the item's current version tag. Read the task with microsoft_planner_get_task (or take it from a task list), pass its @odata.etag exactly as returned (e.g. W/"JzEtVGFzayAg...") as etag to microsoft_planner_update_task. The description, checklist and links live in the task's details, which have their own etag: read them with microsoft_planner_get_task_details and pass that etag to microsoft_planner_update_task_details. Updates return the item with its new etag; use that for the next change. 412 means someone changed the item in between: read it again and retry.

Assignments: keyed by Microsoft Entra user id, e.g. {"fbab97d0-4932-4511-b675-204639209557": {"@odata.type": "#microsoft.graph.plannerAssignment", "orderHint": " !"}}. The signed-in user's id comes from microsoft_planner_get_me; other people's ids from the assignments of tasks they already have. {"<id>": null} removes someone. This connector cannot look up colleagues by name.

Dates: dueDateTime and startDateTime are UTC timestamps (2026-10-31T16:00:00Z). Convert the user's local time before sending, and convert back before quoting.

Rate limits: Microsoft Graph throttles Planner per user and per app. A throttled call answers 429 with Retry-After; wait and retry.

Common errors

• 401 InvalidAuthenticationToken: the authorization was revoked or the client secret expired. Paste a new secret if needed and click Authorize with Provider again.
• 403: Tasks.ReadWrite is missing or not consented, the user is not a member of the plan's group, or a limit was reached (e.g. too many tasks or buckets in the plan). Personal Microsoft accounts always get 403 or 400 here.
• 404: the id is wrong or the item was deleted.
• 409 or 412: the etag is outdated; read the item again and retry with its new @odata.etag.
• 400: a value has the wrong shape, e.g. a bucket of another plan, an assignment without @odata.type, or a date without a time zone designator.

Out of scope here: creating or deleting plans, task comments (they live in the group's conversations), attachments uploaded as files, Planner premium (Project) plans, and looking up people in the directory.