Feature Request: Configurable Azure/M365 OAuth Scopes

[TonyBonFIRE]

Description

Currently, the outlook-mcp MCP application has Azure/M365 OAuth scopes hard-coded in two separate files: outlook-auth-server.js (for scopes requested during the OAuth flow) and config.js (for scopes used by MCP tools when calling the Microsoft Graph API). These must be kept in sync, and any changes require patching both files in the Dockerfile, followed by rebuilding and redeploying the Docker image. This limits flexibility for users who need to customize the scopes based on their specific use cases. I propose adding support for configuring OAuth scopes through environment variables or configuration files, allowing runtime adjustments without requiring code changes or Docker image rebuilds.

Benefits

Least Privilege Security Model

By making OAuth scopes configurable, users can implement a true least privilege approach:

• Expand scopes only as needed: For basic email reading, users can limit scopes to Mail.Read instead of including broader permissions like Mail.ReadWrite or Calendars.ReadWrite.
• Contract scopes for specific workflows: Organizations with restricted access policies can dial back scopes to match exactly what their MCP implementation uses, reducing security risk from over-permissive tokens.
• Compliance alignment: This enables easier compliance with organizational security policies that require minimal necessary permissions.

Runtime Configuration Flexibility

• No rebuild required: Changes to scopes can be made via environment variables or config files, allowing immediate deployment without Docker image rebuilds.
• Dynamic adaptation: Users can adjust scopes based on changing requirements (e.g., adding calendar access for new workflows) without downtime or development cycles.
• Environment-specific tuning: Different environments (dev/staging/prod) can have tailored scope configurations without maintaining separate code branches.

Improved Code Quality

Consolidating scope definitions into a single, configurable location would eliminate the current duplication across outlook-auth-server.js and config.js. This would:

• Reduce maintenance overhead by removing the need to manually sync two separate arrays
• Prevent potential bugs from mismatched scopes between authentication and API calls
• Make the codebase more maintainable and less error-prone

Proposed Implementation

Add support for a configuration option like:

• Environment variable: OAUTH_SCOPES (comma-separated list, e.g., Mail.Read,Calendars.Read)
• Config file entry: oauth.scopes array
• Default to current hard-coded scopes for backward compatibility

This would allow users to specify scopes that precisely match the API calls their MCP implementation uses, promoting both security and operational efficiency.

Use Case Example

In my homelab setup, I run outlook-mcp in a Docker container. Currently, any scope changes require:

1. Modifying the source code in two files (outlook-auth-server.js and config.js)
2. Updating the Dockerfile patches
3. Rebuilding the Docker image
4. Redeploying the container

With configurable scopes, I could simply update an environment variable and restart the container, enabling rapid iteration and security tuning.

Would you consider implementing this feature? I'd be happy to contribute to the implementation or provide more details about my specific use case.

[ryaker]

@claude

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[TonyBonFIRE]

@ryaker ... checking in. It looks like @claude was not able to successfully review and move this request forward. Are you interested in this change? Thanks in advance.