Windsurf: Devin Connects to Microsoft 365 Apps
WindsurfWindsurf added six new Microsoft 365 plugins to Devin's MCP marketplace, covering Mail & Contacts, Calendar, To Do, OneDrive & SharePoint, Teams, and Directory (Entra ID). Each plugin bundles the matching MCP server with a usage skill, connects through a custom Microsoft Entra app registration, and defaults to read-only permissions when no OAuth scope is explicitly configured. The Files MCP can also convert documents to PDF or JPG on the fly, giving Devin a direct line into the Microsoft productivity stack many teams already run their day on.
Key Takeaways
- Windsurf added six Microsoft 365 plugins to Devin's marketplace: Mail & Contacts, Calendar, To Do, OneDrive & SharePoint, Teams, and Directory (Entra ID).
- Each plugin bundles its MCP server with a usage skill, so Devin has built-in guidance on how to use the connection, not just raw API access.
- Setup requires a custom Microsoft Entra app registration rather than a single shared OAuth app, giving organizations control over the connection.
- Devin defaults to read-only permissions whenever no OAuth scope is explicitly configured, a safer default for mail, calendar, and Teams access.
- The Files MCP can now convert and return documents as PDF or JPG, useful when handing files back to human collaborators.
- The addition follows Windsurf's 21 new one-click MCP integrations from Sep 11 and continues a steady expansion of Devin's marketplace toward the tools teams already use daily.
Microsoft 365 Joins Devin's MCP Marketplace
Windsurf expanded Devin's MCP marketplace with six new plugins covering the core of Microsoft 365: Mail & Contacts, Calendar, To Do, OneDrive & SharePoint, Teams, and Directory (Entra ID). Each plugin pairs its MCP server with a matching usage skill, so Devin knows not just how to call the underlying API but how and when to use it inside a session.
How It Connects
Unlike some of Devin's zero-config MCP integrations, Microsoft 365 access is set up through a custom Microsoft Entra app registration rather than a single shared OAuth app. Once an admin registers the app, users pick OAuth scopes from a list that explains what each permission actually grants, and Devin connects with read-only permissions by default whenever no scope has been configured. That default matters for anything touching email, calendar, or Teams messages, where an overly broad grant could let Devin take actions a team didn't intend.
What Devin Can Do With It
With these plugins installed, Devin can read and act on Outlook mail and contacts, check and manage calendar events, work with To Do lists, browse and edit files in OneDrive and SharePoint, and participate in Teams conversations, in addition to querying an organization's Directory through Entra ID. The Files MCP also gained the ability to return documents converted to PDF or JPG, which is useful when Devin needs to hand a file back to a person rather than another tool.
Why It Matters
Microsoft 365 is the productivity backbone for a large share of software teams, particularly outside pure startup environments. Wiring Devin directly into Outlook, Teams, and OneDrive/SharePoint means it can pull context from email threads, join the conversations where decisions actually happen, and file work products where colleagues already look for them, without a developer manually bridging that gap. It's a meaningful widening of where Devin can operate, alongside the growing MCP marketplace Windsurf has been building out over the past several weeks.