Gemini Enterprise With Microsoft 365: Connecting SharePoint, OneDrive, Outlook, and Teams

Plenty of organizations run both ecosystems: Google Workspace for some teams, Microsoft 365 for others, or Microsoft 365 for everything with Google Cloud for AI. Gemini Enterprise is designed for that reality. Its Microsoft connectors let one question search SharePoint, OneDrive, Outlook, and Teams alongside Drive, Jira, and ServiceNow, and, increasingly, act in them.

This guide covers each Microsoft 365 connector, the Entra ID app registration and permissions, federated vs. ingested modes, actions, limits, and a rollout plan that keeps your Microsoft admins comfortable.

For connector fundamentals (data stores, sync types, and permission-aware search) start with our connectors guide.

Table of contents

Open Table of contents

• Gemini Enterprise Microsoft 365 Connectors at a Glance
• Federated or Ingested? The Microsoft-Specific Trade-Offs
• SharePoint: Setup and Permissions
• Outlook: Mail, Calendar, and More
• Teams: Channels, Chats, and Schedules
• Identity: Making Permissions Work Across Clouds
• Security Considerations for Microsoft Admins
• Troubleshooting Common Errors
• A Rollout Plan
• Conclusion

Gemini Enterprise Microsoft 365 Connectors at a Glance

In September 2026 Google also added actions for OneDrive, Outlook, SharePoint, and Teams in Preview, so agents can create, update, and send, not just search.

Google also said at Gemini at Work 2026 that the Gemini agent can be accessed from Microsoft 365, alongside Workspace and Slack. Google hasn’t published setup details or availability dates for that integration, so this guide focuses on the connectors you can deploy today.

---

Federated or Ingested? The Microsoft-Specific Trade-Offs

Rule of thumb: start with federated for Teams and Outlook (fast-changing, personal content) and decide between federated and ingested for SharePoint based on how good your SharePoint search is today.

---

SharePoint: Setup and Permissions

1. Register an app in Entra ID

In the Entra admin center → Entra ID → App registrations → New registration:

• Account type: Accounts in this organizational directory only (single tenant)
• Redirect URIs (Web):
  • https://vertexaisearch.cloud.google.com/console/oauth/sharepoint_oauth.html
  • https://vertexaisearch.cloud.google.com/oauth-redirect
• Collect the Client ID, a client secret (copy the value immediately), the Tenant ID, and your instance URI: https://DOMAIN.sharepoint.com for all sites or https://DOMAIN.sharepoint.com/sites/SITE for one

For ingestion with federated credentials, add a federated credential with issuer https://accounts.google.com and the subject identifier shown in the Google Cloud console while creating the data store. No long-lived secret required.

2. Grant API permissions

3. Use Sites.Selected to limit scope

Sites.FullControl.All is a big ask for most security teams. Sites.Selected limits the app to sites you choose:

• Grant fullcontrol to the app on each site with PnP PowerShell (Grant-PnPAzureADAppSitePermission -Permissions FullControl) or a Graph POST /sites/{SITE_ID}/permissions call. Run by a site owner
• Then set the instance URI to that site, or add precise siteName filters on the data store

4. Grant admin consent

Tenant-wide admin consent is required, and Google calls it a critical failure point. There are two app IDs to consent: the data store connection and the “Upload from OneDrive/SharePoint” button in chat. If users see “Need admin approval,” an admin must sign in to the Gemini Enterprise web app and choose Consent on behalf of your organization: recreating the data store won’t fix it.

5. Create the data store

In the Gemini Enterprise console: Data stores → Create → Microsoft SharePoint, choose the mode, authenticate, set the site URL and cloud environment, add filters, pick entities and sync schedules, choose actions, select the region and encryption, and create. Then connect it to your app.

You’ll need the Discovery Engine Editor role in Google Cloud.

SharePoint filters and options

• Federated: filter by exact site URL, or by path (subpaths, folders, document libraries), each as include or exclude
• Ingestion: include or exclude entities by key
• Real-time sync (Preview, ingestion only): webhook-based updates for document entities; permission changes still wait for scheduled syncs
• US government tenants: match the environment type and cloud (GCC High or DoD)

Important: if you only want read access, disable the default write actions. Leaving them on without matching write scopes in Entra ID causes authentication and sync errors.

---

Outlook: Mail, Calendar, and More

Actions available: send (with attachments), forward, reply, move, download attachments, create and update drafts; create, update, and RSVP to events; create and update contacts; read and edit Excel workbooks; create Word and PowerPoint files in OneDrive; and convert Word and PowerPoint to PDF.

Limits to plan around:

• Mailboxes must be fully in Exchange Online: hybrid or on-premises mailboxes fail with MailboxNotEnabledForRESTAPI
• One Azure tenant per data store: multi-tenant organizations need one per tenant
• Roughly one transaction per second per node, with Graph retry-after handling
• 25 MB maximum file size for uploads and downloads

If you’re mid-migration between Exchange and Gmail, our coexistence guide explains routing, and why hybrid mailboxes complicate API access.

---

Teams: Channels, Chats, and Schedules

The Teams data store lets users search and act on channels, chats, and schedules. It’s federated (nothing is ingested) with two modes:

Group.Read.All lets the connector read sensitivity labels for redaction.

Actions include sending, updating, and creating channel and chat messages, channels, and chats; adding members to channels; creating schedules; and creating and updating time-off entries. Supported locations are global, us, and eu, and the connector requires Teams 2.1 or later.

---

Identity: Making Permissions Work Across Clouds

Permission-aware search depends on Gemini Enterprise knowing that alex@company.com in Google and alex@company.com in Entra ID are the same person. You have two broad options:

1. Google identity: users sign in to Gemini Enterprise with Google accounts (Workspace or Cloud Identity); Google made Google Identity support for third-party data sources generally available in August 2026, except for Microsoft 365 data ingestion, so this option suits federated Microsoft 365 data stores while ingested SharePoint and Outlook data stores need workforce identity federation; the Entra ID connector brings in Microsoft directory data
2. Workforce identity federation: users sign in with Entra ID through a workforce identity pool, and Gemini Enterprise maps that identity to Microsoft permissions

Either way, keep user principal names and email addresses consistent across both directories: mismatches are the top cause of “I can see it in SharePoint but not in Gemini.” If you already federate Google sign-in to Entra ID, our SSO guide covers the SAML side.

---

Security Considerations for Microsoft Admins

---

Troubleshooting Common Errors

---

A Rollout Plan

---

Conclusion

Gemini Enterprise treats Microsoft 365 as a first-class source. SharePoint, OneDrive, Outlook, and Teams connectors are generally available, Outlook actions are GA, and actions across the rest of Microsoft 365 are arriving in Preview. The work is mostly on the Microsoft side: a well-scoped Entra app, the right permissions, admin consent, and clean sharing in SharePoint.

Start federated, scope tightly with Sites.Selected, and keep write actions off until you need them. Whether your organization is all-in on Microsoft, mixed, or moving toward Google Workspace, one permission-aware search across both ecosystems is one of the quickest wins Gemini Enterprise offers.

---

Official Google documentation:

• Microsoft SharePoint configuration
• Set up a Microsoft SharePoint data store
• Microsoft Teams connector
• Microsoft Outlook connector
• Gemini Enterprise release notes
• Connect a third-party data source

Related reading:

• Gemini Enterprise Connectors and Data Stores: federated vs. ingested data and sync schedules.
• Google Workspace vs. Microsoft 365: how the two suites compare.
• Google Workspace and Microsoft 365 Coexistence: running both side by side.
• Migrating from Microsoft 365 to Google Workspace: if you are moving off Microsoft 365 rather than connecting to it.