Cue is Fountain's AI assistant. The Microsoft 365 connector lets Cue read from and act in your Microsoft 365 environment: Outlook mail and calendar, Teams messages, and SharePoint and OneDrive files. One connector covers all of these.
Ask Your IT Team to Turn This On
Your company's Microsoft administrator turns on Microsoft 365 for Cue once, for everyone. This is a Microsoft requirement, not a Fountain one. They don't need a Fountain account to do it. Send them the link to this page: everything they need is in Microsoft Administrator Setup below. Once it's on, you connect your own account from Skills & Connectors.
Microsoft Administrator Setup
These steps are completed once by your Microsoft Global Administrator, or by a user with the Entra AI Administrator role.
Step 1: Enable Your Organization for Work IQ
Microsoft 365 access runs through Microsoft's Work IQ service.
Your Microsoft admin must provision the Work IQ service principal, app ID fdcc1f02-fc51-4226-8753-f668596af7f7, and set up a Copilot Credits usage-based billing plan with users assigned to it. No per-user Microsoft 365 Copilot license is required.
Follow Microsoft's Work IQ tenant setup instructions.
Step 2: Approve Org-Wide Access
When someone selects org-wide access on the Microsoft 365 connector card in Cue, a confirmation window explains that your organization's Microsoft admin needs to approve access once, for everyone.
If you are the Microsoft admin: select Approve now. You are taken to Microsoft's own screen to review and approve. This happens on Microsoft's side, so nothing else needs to be set up in Fountain first.
If you are not the admin: select Copy admin consent link and send it to whoever manages Microsoft 365 at your company. They open it and approve on Microsoft's side. They do not need a Fountain account to do this.
What Org-Wide Access Actually Grants
Approving unlocks the ability for your organization to connect. It does not connect anyone automatically, and it does not give Cue a pooled view of everyone's data. Each person still connects their own account, and Cue only ever sees what that individual person can see.
Step 3: Enable Write Actions
Complete this step only if you want Cue to send and create on your users' behalf.
In the Microsoft 365 admin center, go to Agents → Tools → Work IQ MCP → Policy → Mutations and turn on Allow write actions. Microsoft blocks Work IQ create, update, delete, and send actions by default. Saving and reading file contents use Microsoft Graph directly and do not depend on the Work IQ mutation policy. Delete is a separate toggle that can be left off.
Permissions and Data Access
Fountain Cue is Fountain's multi-tenant Microsoft Entra app. Microsoft's consent screen shows Fountain Cue, published by OnboardIQ, with a verified publisher badge. Cue connects to Microsoft 365 as you; it does not install Fountain agents inside Microsoft 365.
The admin-consent link explicitly requests these three delegated permissions, not application-level permissions:
WorkIQAgent.Ask: lets Cue ask Microsoft Work IQ to read and act on Microsoft 365 data on your behalf. Microsoft requires admin consent for this permission.
Files.ReadWrite.All: Microsoft Graph permission to read and save OneDrive and SharePoint files. Microsoft describes it as "Have full access to all files user can access".
offline_access: lets Microsoft issue a refresh token so Cue can stay connected without repeated sign-ins.
Microsoft may also show "Sign in and read user profile" on its consent screen. Admin consent does not give Fountain tenant-wide data access or app-only access. Each person must connect their own account before Cue can read their data.
Cue can access only the Outlook mail and calendar, Teams chats, and SharePoint and OneDrive files that the connecting user can access. Disconnecting removes Fountain's stored tokens. It does not revoke the organization's Microsoft consent or revoke tokens at Microsoft.
Microsoft blocks Work IQ create, update, delete, and send actions by default. Your IT team can enable supported writes in Microsoft 365 admin center → Agents → Tools → Work IQ MCP → Policy. Saving and reading file contents use Microsoft Graph directly and do not depend on the Work IQ mutation policy. A Fountain admin can further restrict connector tools with Allow, Ask, or Block.
Read Microsoft's admin-consent documentation and Work IQ policy controls.
Connect Your Account
Each user connects their own account.
In Fountain, open Cue in the left navigation and select Skills & Connectors.
In the Connectors (MCP) section, find Microsoft 365 and select Connect.
Sign in through Microsoft and approve.
No individual Microsoft 365 Copilot license is required. Cue can only ever access what your own Microsoft 365 permissions already allow.
What Cue Can Do
Once you are connected, Cue can read the following.
Search and read Outlook mail
Read your calendar
Read Teams chat and channel messages
Search SharePoint and OneDrive files
Read meeting transcripts
File actions are also available once you are connected, and do not depend on the mutation policy.
Save a file from a Cue conversation to your OneDrive or a SharePoint library
Read a OneDrive or SharePoint file's contents into a Cue conversation
Saving always creates a file. If the name is already taken, Microsoft saves it under a slightly different name and Cue tells you which name it used — it never overwrites a file you already have.
Write actions become available once your admin has enabled the mutation policy described in Step 3: Enable Write Actions.
Send email from Outlook
Create and update calendar events
Send Teams messages
Ask Cue in plain language. For example:
"What's on my calendar this week?"
"Search my email for the offer letter from [name]."
"Send [name] a Teams message letting them know the interview is confirmed."
Privacy and Control
You only expose what you can already see. Cue acts as you, so it never reaches data your Microsoft 365 account can't. Microsoft's sensitivity labels and compliance policies still apply.
You sign in through Microsoft. Fountain never sees your password.
Your admins control connector tools. Microsoft tenant policy governs Work IQ write actions. Graph file saving does not depend on that policy. A Fountain admin can further restrict connector tools with Allow, Ask, or Block.
Troubleshoot Common Issues
Cue can read my mail and calendar but can't send anything
Your admin has not enabled write actions. Ask them to turn on the mutation policy described in Step 3: Enable Write Actions. Changes can take up to 24 hours to take effect.
File Saving Is Not Affected
Saving files does not depend on the mutation policy. It is covered by the org-wide approval in Step 2: Approve Org-Wide Access instead.
I don't see Microsoft 365 in Cue, or connecting fails
Your Microsoft admin has not finished the setup yet, and individual users cannot finish it themselves. Send them this page. If the error mentions Work IQ or asks you to contact your IT Admin, your admin needs to complete Step 1: Enable Your Organization for Work IQ. If Microsoft says the app needs admin approval, your admin needs to complete Step 2: Approve Org-Wide Access.