Microsoft To Do

Microsoft To Do

This connector works with the signed-in user's Microsoft To Do through Microsoft Graph v1.0 (https://graph.microsoft.com/v1.0, /me/todo/lists): task lists, tasks with due dates, reminders, notes and categories, checklist steps and linked resources. To Do is the same task store as Outlook tasks, so tasks appear in the To Do app, in Outlook and in Teams. It works with work or school accounts (Microsoft 365) and with personal Microsoft accounts. Everything runs as the user who authorized the connector.

Setup (one-time, about 10 minutes)

1. Open https://entra.microsoft.com (or https://portal.azure.com) → Applications → App registrations → New registration.
2. Name it (e.g. "AnythingMCP Microsoft 365") and choose the supported account types:
   • Accounts in this organizational directory only (single tenant): only your organisation's users can sign in. Set MICROSOFT_TENANT_ID to the Directory (tenant) ID shown on the app's Overview page (a GUID), or to your domain such as contoso.onmicrosoft.com.
   • Accounts in any organizational directory (multi-tenant): set MICROSOFT_TENANT_ID to organizations.
   • ... and personal Microsoft accounts: set MICROSOFT_TENANT_ID to common (work, school and personal accounts) or consumers (personal accounts only). The value must match the app's account type, otherwise Microsoft refuses the sign-in (AADSTS50194 or AADSTS50020).
3. Under Redirect URI pick platform Web and enter https://cloud.anythingmcp.com/api/mcp-oauth/callback on AnythingMCP Cloud, or <your AnythingMCP URL>/api/mcp-oauth/callback when you host AnythingMCP yourself. It must match character for character (AADSTS50011 otherwise).
4. API permissions → Add a permission → Microsoft Graph → Delegated permissions: add offline_access, User.Read, Tasks.ReadWrite.
5. Certificates & secrets → New client secret. Copy the secret Value (not the Secret ID); it is shown once. Note its expiry date: when it expires the connector stops working until you paste a new one.
6. Paste the Application (client) ID into MICROSOFT_CLIENT_ID, the secret value into MICROSOFT_CLIENT_SECRET, the tenant value from step 2 into MICROSOFT_TENANT_ID, and install.
7. On the connector page click Authorize with Provider and sign in with the account whose tasks the AI should work with. The refresh token is stored encrypted and access tokens (about 1 hour) are renewed automatically.

One Entra app for all Microsoft connectors: the app registration made for the Outlook connector works here as well. Open it, add the delegated permissions from step 4 under API permissions, keep the same redirect URI, and reuse the same MICROSOFT_CLIENT_ID, MICROSOFT_CLIENT_SECRET and MICROSOFT_TENANT_ID. Each connector asks only for its own scopes when you authorize it. The permissions per connector:

• Outlook: Mail.ReadWrite, Mail.Send, Calendars.ReadWrite
• OneDrive: Files.ReadWrite
• Excel: Files.ReadWrite (plus Files.ReadWrite.All for workbooks in SharePoint or shared with the user)
• SharePoint: Sites.ReadWrite.All and Files.ReadWrite.All
• OneNote: Notes.ReadWrite
• Microsoft To Do: Tasks.ReadWrite
• Planner: Tasks.ReadWrite Every connector also needs offline_access and User.Read.

Admin consent: these delegated permissions normally do not need an administrator, but many organisations turn off user consent. If the sign-in shows "Need admin approval" (AADSTS65001 or AADSTS90094), a tenant administrator opens the app registration → API permissions → Grant admin consent for <organisation> once; afterwards every user can authorize. Each connector still works only with what the account that signed in may see.

Scopes: offline_access User.Read Tasks.ReadWrite. offline_access is what makes Microsoft issue a refresh token; without it the connector stops an hour after authorizing. The Planner connector uses the same Tasks.ReadWrite permission. For a read-only setup, use offline_access User.Read Tasks.Read, authorize again, and disable every tool that creates, changes or completes something.

Confirm writes: before creating, changing or completing a list, task or step, tell the user what you are about to do and wait for a yes.

Switched off at install: microsoft_todo_delete_task and microsoft_todo_delete_list. Turn them on per tool only if the AI should delete.

Lists: microsoft_todo_list_lists first. The list with wellknownListName defaultList is the user's standard "Tasks" list; use it when the user does not name a list. flaggedEmails holds the mails flagged in Outlook.

Finding tasks: microsoft_todo_list_tasks with filter status ne 'completed' gives the open tasks; importance eq 'high' the important ones. To answer "what is due this week", list the open tasks and compare dueDateTime yourself.

Dates: due, start and reminder are objects {"dateTime": "2026-10-20T09:00:00", "timeZone": "Europe/Berlin"} without an offset in dateTime. To Do keeps only the day of a due date, so send it as T00:00:00 in the user's time zone. A reminder also needs is_reminder_on true. Answers carry dates in UTC unless stated otherwise; convert before quoting a time to the user.

Status: notStarted, inProgress, completed, waitingOnOthers, deferred. microsoft_todo_complete_task ticks a task off; reopen it with microsoft_todo_update_task and status notStarted.

Steps and links: checklist steps belong to one task (microsoft_todo_list_checklist_items, microsoft_todo_add_checklist_item, microsoft_todo_update_checklist_item). Linked resources attach a URL from another app (microsoft_todo_add_linked_resource).

Pagination: microsoft_todo_list_tasks answers carry @odata.nextLink while more tasks exist. Call it again with skip set to the $skip value in that link (and the same other arguments).

Rate limits: Microsoft Graph throttles per user and per app. A throttled call answers 429 with Retry-After; wait and retry.

Common errors

• 401 InvalidAuthenticationToken: the authorization was revoked or the client secret expired. Paste a new secret if needed and click Authorize with Provider again.
• 403: Tasks.ReadWrite is missing or was not consented, or the list is shared with the user without edit rights. A write on a read-only setup also ends here.
• 404: the list or task id is wrong, the item was deleted, or the task moved to another list (a task's id changes when it moves).
• 400: a field has the wrong shape, e.g. a date without timeZone, or a rename of a built-in list.
• A work or school account without an Exchange Online mailbox has no To Do; Graph then answers with an error about the mailbox.

Out of scope here: file attachments on tasks, recurrence patterns, sharing lists with other people, and other users' tasks.