Connect Gmail or Outlook to AI With Read-Only Access
Last updated: August 11, 2026A read-only email connection lets an AI tool view and summarize your inbox without ever being able to send, delete, or modify anything. On Gmail this is the gmail.readonly OAuth scope; on Microsoft 365 it is the Mail.Read Graph API permission. We use this exact setup to scan a small set of newsletter subscriptions and summarize industry trends automatically, and it is the pattern we recommend for any unattended AI connection to a business inbox.
We built this for our own use first: a handful of newsletters that reliably break industry news before anyone else, connected to an AI tool that reads only those subscriptions and tells us what changed. No dashboard to check, no inbox to open. The part that makes teams comfortable running this unattended isn't a policy or a promise, it's the permission scope itself.
Dahlia walks through it in a short video below. Then this guide covers the exact scopes, consent screens, and setup steps for both Google and Microsoft.
Watch: the read-only email connection, hack 31 of 30
Why read-only, not full inbox access
Connecting any AI tool to a live inbox raises an obvious question: what stops it from sending something it shouldn't? The answer we build toward for clients is not "we trust the prompt," it's "the permission itself doesn't allow it." Google and Microsoft both offer scoped, named permissions below full account access, and read-only is the narrowest one that still lets a tool do the summarization work. A connector authorized only for gmail.readonly or Mail.Read cannot send, delete, or forward a message, regardless of what instruction it receives. That's not a behavioral guarantee, it's a structural one, and it's the difference we build every unattended email integration around.
Step-by-step: connect Gmail with read-only access
Create a project and OAuth credentials in Google Cloud Console
In the Google Cloud Console, create (or select) a project, enable the Gmail API, and create OAuth 2.0 credentials. Google requires this step for any application that will request access to a Gmail account, including MCP connectors and other AI tooling.
Restrict the scope to gmail.readonly
When configuring the OAuth consent screen and the scopes your application requests, select https://www.googleapis.com/auth/gmail.readonly specifically. Do not add gmail.send, gmail.modify, or the broader mail.google.com scope unless the tool genuinely needs to send or manage mail. Requesting only what the task requires is the entire safety model here.
Authorize through your MCP email connector
Most Gmail MCP connectors walk you through this OAuth flow directly: you'll see Google's consent screen naming the exact permission being granted, something like "View your email messages and settings," before you approve it. If the screen mentions sending or deleting, stop and check which scope was actually requested.
Expect to re-authorize periodically
OAuth access tokens expire. Build periodic re-consent into how you maintain the connection rather than treating setup as one-and-done. This is a feature: it means read-only access isn't standing forever without anyone checking it.
Step-by-step: connect Outlook or Microsoft 365 with read-only access
Register an application in Microsoft Entra ID
In the Microsoft Entra admin center (formerly Azure AD), register a new application to get a client ID and set up the permissions it can request against Microsoft Graph.
Grant only the Mail.Read permission
Under API permissions, add Mail.Read from Microsoft Graph and explicitly avoid Mail.ReadWrite and Mail.Send. Microsoft's permission model keeps these separate on purpose so an application can be scoped to read-only by design, not by convention.
Authorize via consent and connect your MCP tool
Complete admin or user consent for the app registration, then connect it through your MCP email connector the same way as Gmail. The consent screen will name the permission plainly, so verify it says "Read your mail" and not "Send mail as you" before approving.
The comfort here doesn't come from trusting the tool to behave. It comes from the permission itself being incapable of the risky action.
What this actually gives a small team
For us, the practical output is a plain-language digest: what changed this week in the newsletters we've chosen to track, surfaced without opening a single one by hand. Scaled to client work, the same pattern applies to monitoring several inboxes for what actually needs attention versus what can be skipped, always scoped to exactly the access the task requires. We recommend starting with three to five sources you already trust, not your entire subscription list; a summarizer drowning in low-signal newsletters is just a different kind of noise.
- Choose a small, high-signal set of newsletters before connecting anything.
- Confirm the exact OAuth scope on the consent screen: gmail.readonly or Mail.Read, nothing broader.
- Never grant send, modify, or delete permissions to a summarization tool.
- Build periodic token re-authorization into your maintenance routine.
- Treat read-only as the default for any unattended AI email connection, then expand only if the task genuinely requires it.
Frequently Asked Questions
What is the read-only scope for Gmail called?
It is called gmail.readonly. It is one of several distinct OAuth scopes the Gmail API offers, and it only grants permission to view and read mail. It does not include the separate scopes required to send, delete, or modify messages and labels.
What is the equivalent read-only scope for Outlook or Microsoft 365?
It is called Mail.Read in the Microsoft Graph permission model. Microsoft deliberately separates Mail.Read from Mail.ReadWrite and Mail.Send. An application authorized only for Mail.Read cannot send or modify messages, regardless of what it attempts.
Why would a business connect AI to an inbox with read-only access instead of skipping it?
Read-only access lets a team automate the work of monitoring newsletters, subscriptions, and inbound trend signals, without introducing the risk of an automated system sending or deleting something on the team's behalf. It is the narrowest permission that still accomplishes the summarization task, which is the right default for any unattended AI connection to a business inbox.
How often do read-only OAuth tokens need to be re-authorized?
This varies by provider and app configuration, but both Google and Microsoft expire access tokens and require periodic refresh or re-consent. Build re-authorization into your maintenance routine rather than assuming a one-time setup lasts indefinitely.
Sources
- Google for Developers. Gmail API OAuth 2.0 Scopes. developers.google.com/workspace/gmail/api/auth/scopes
- Microsoft Learn. Microsoft Graph permissions reference. learn.microsoft.com/graph/permissions-reference
- Model Context Protocol. Official documentation. modelcontextprotocol.io