Will an AI Agent Work With the Excel, Outlook and QuickBooks You Already Use?
What Microsoft and Intuit document about letting outside software read your mail, edit your spreadsheets and post to your books, and where each reach stops.
Which of Outlook, OneDrive, Excel and QuickBooks Online an outside program can read, edit or write to, where each reach stops, and a design that keeps every change to your books behind a person's sign-off.
Quick Answer
Yes, under three conditions: the spreadsheets an agent edits are Office Open XML workbooks in OneDrive for Business, SharePoint or a Group drive, whoever administers your Microsoft account grants mailbox access narrowly, and nothing reaches QuickBooks Online until a person approves it. Editing a workbook and posting to the books carry the strictest limits, so the agent prepares the work and the person who handles invoices today approves it. The books never leave QuickBooks.
What is a system of record? A system of record is the place a business treats as the official copy of one kind of data. QuickBooks holds the books, a mailbox holds correspondence, and a spreadsheet holds a price list.
Buyers raise this question early because it decides whether adopting an agent means starting over. The sections below take each tool in turn, using Microsoft's and Intuit's own documentation.
Statistics Canada's Canadian Survey on Business Conditions ran from early April to early May 2026, with 9,251 responding businesses from a sample of 21,105. It found 19.2% of businesses used AI to produce goods or deliver services in the prior 12 months, up from 6.1% in the second quarter of 2024. Cybersecurity or privacy concerns (13.4%) and cost (10.6%) were the two most common barriers that limit AI use (Statistics Canada, Analysis on artificial intelligence use by businesses in Canada, second quarter of 2026). The survey measures AI use in general. It does not measure whether an agent fits Excel, Outlook or QuickBooks, which is what the sections below cover.
Outlook: what the agent can see
Microsoft Graph, the interface Microsoft publishes for outside software, lists the messages in a signed-in user's mailbox, including the Deleted Items folder (Microsoft Learn, List messages). The same page shows a call that targets one mail folder, such as a folder that only receives supplier invoices.
The folder path chooses what a single request asks for, while the permission decides what the program may ask for. Microsoft's page gives the least-privileged permission for listing messages as Mail.ReadBasic for both work and personal accounts, with Mail.Read above it (Microsoft Learn, List messages). Microsoft describes the application version of Mail.ReadBasic as reading email "except the body, previewBody, attachments, and any extended properties" (Microsoft Learn, RBAC for Applications in Exchange Online). The Graph List messages page lists that application permission as Mail.ReadBasic.All (Microsoft Learn, List messages). A job that never opens message bodies or attachments could hold the basic permission. Opening invoice PDFs needs Mail.Read, which is the permission Microsoft lists for listing a message's attachments.
An agent that runs overnight with no one signed in uses an application permission. Microsoft describes the application version of Mail.Read as allowing the app "to read email in all mailboxes without a signed-in user" (Microsoft Learn, RBAC for Applications in Exchange Online). Microsoft describes narrowing it to specific mailboxes with RBAC for Applications in Exchange Online, which it says replaces Application Access Policies. Microsoft adds a trap: if an unscoped Mail.Read grant also exists in Microsoft Entra ID, the two combine and "results in no effective resource scoping" (Microsoft Learn, RBAC for Applications in Exchange Online). Ask your administrator to show the effective scope of the grant.
This covers work, school and personal Microsoft accounts, the account types Microsoft's page names (Microsoft Learn, List messages). Mail hosted elsewhere and then opened in Outlook is checked separately.
OneDrive: reading the files you already have
An agent can download the contents of a file stored in OneDrive. Microsoft's page says only items with the file property can be downloaded, and it lists Files.Read as the least-privileged permission for work, school and personal accounts when a person is signed in. Application access, with no one signed in, lists Files.Read.All (Microsoft Learn, Download driveItem content).
The original stays in its folder, and the download hands the agent a copy through a pre-authenticated link that Microsoft says might expire within minutes (Microsoft Learn, Download driveItem content). Where that copy is processed, how long it is kept and when it is deleted are design decisions, and the scope should name them.
Downloading a file and understanding its contents are separate jobs. A scanned price list takes more work than a tidy table.
Excel: editing has more conditions than reading
Reading a spreadsheet is the OneDrive case above, where the agent works from a downloaded copy. Editing it in place goes through Microsoft's Excel interface, and that interface carries the most conditions of the four tools. Microsoft says it works on workbooks stored in OneDrive for Business, SharePoint or a Group drive. It "supports only Office Open XML file formatted workbooks," and "the .xls extension workbooks aren't supported" (Microsoft Learn, Working with Excel in Microsoft Graph). Editing needs Files.ReadWrite, one step above Files.Read.
The same page says support for workbooks in the consumer OneDrive platform "is still not available." The page is dated March 2024, so check the current position before you plan around it. Microsoft separates its business and consumer OneDrive platforms, and an email address alone does not tell you which one holds a given workbook.
Reading and editing have different limits. An agent can download a copy of a file it has permission to reach. Editing a workbook in place needs an Office Open XML workbook in OneDrive for Business, SharePoint or a Group drive, and Microsoft's page, dated March 2024, says consumer OneDrive workbooks were not supported.
How an edit is saved depends on the session. Microsoft lists three modes. In a persistent session "all changes made to the workbook are persisted." In a non-persistent session changes "aren't saved to the source location." A call with no session persists its changes to the file (Microsoft Learn, Working with Excel in Microsoft Graph). A non-persistent session is created with persistChanges set to false, and its session ID is passed in the workbook-session-id header. An agent that touches a live price list should work on a copy, or use a non-persistent session for calculations it does not want saved.
QuickBooks Online: what the connection allows
Intuit's page says apps can use the invoice record "to create, read, or send invoices" in QuickBooks Online, and it lists Invoice, Bill, Payment and BillPayment among its transaction entities (Intuit Developer, What you can do with the QuickBooks Online Accounting API). The page names creation only for invoices, so the assessment confirms the exact operations for Bill and Payment in Intuit's API Explorer before a design relies on them. This article covers QuickBooks Online only; QuickBooks Desktop is checked separately.
The same page says a hard delete of a transaction record such as an invoice "permanently deletes the entity," and that "you can't undo hard deletes." It adds that Bill, BillPayment, Invoice, Payment and several other records support a "simplified delete" that needs only the record's ID and a sync token (Intuit Developer). Intuit therefore documents that Bill records can be deleted through the API, so the design has to rule delete out. Whether a connection can be limited to read-only is checked at the assessment against Intuit's current authorization documentation. Where it cannot, the restraint has to come from how the agent is built: it never calls delete, and it creates a record only after a person approves.
Not sure where AI fits in your operations?
Take the Free AI Readiness Scorecard →A workflow that respects those limits
Here is a supplier-invoice workflow built on those connections. It is a proposed design with no measured results behind it.
A supplier invoice arrives as a PDF attached to a message in the invoices folder. The agent lists the message, then makes a separate call to list that message's attachments, which Microsoft's example response shows carry the file content and which needs Mail.Read (Microsoft Learn, List attachments). The agent pulls out the vendor name, invoice number, date and total, and checks the total against the purchase order or price list that it downloads as a copy from OneDrive. Next, it looks the vendor up in QuickBooks and sends the extracted fields to a person, with the original PDF beside them, in a message or screen the team already checks. The person approves, corrects or rejects. Only after approval does the agent create the bill in QuickBooks, an operation the assessment confirms first.
Pulling the fields out of the PDF is the agent's own work and no vendor documents it, which is why a person sees the result before anything is posted.
| Step | System | What the agent does | Who decides |
|---|---|---|---|
| 1 | Outlook | Lists the message, then lists its attachments (needs Mail.Read) | No decision, read only |
| 2 | OneDrive | Downloads a copy of the purchase order or price list | No decision, read only |
| 3 | QuickBooks | Looks up the vendor record | No decision, read only |
| 4 | Review screen | Shows the extracted fields beside the source PDF | A person approves, corrects or rejects |
| 5 | QuickBooks | Creates the bill after approval | The person who approved |
Modelled outcome of this design, counted from the table above and not measured: five steps, three of them read-only, one a person's review and one a write. The single write runs only after approval, so no bill reaches QuickBooks without a named person's sign-off. The design makes no delete call. Outlook, OneDrive and QuickBooks each keep their data where it is today. No time saved or error rate is claimed.
Where the official record stays
Owners ask a sharper version of the question: is this a professional system, and can it record payments? An agent can prepare a payment record for a person to approve, and QuickBooks is what records it. Intuit lists Payment and BillPayment among its transaction entities.
The ledger, the bank reconciliation and the month-end close stay in QuickBooks and with whoever keeps your books. The agent handles the work around them: reading the inbox, extracting the fields, matching the vendor and preparing the entry. Switch the agent off tomorrow and the books are still in QuickBooks.
Ask any vendor where the official record lives after launch. If the answer is anywhere other than your accounting software, you are being asked to move it. For the wider question of where an agent's data lives, see where an AI agent's data lives.
What does not fit
Text messages are a separate channel from email and need their own check. Older file formats, spreadsheets in personal accounts and heavily customised macros can each break the fit, so check them early.
An agent also needs a person to own it. Someone approves drafts, notices when a supplier changes an invoice layout and decides when a rule should change. The person who handles invoices today can clear the review screen, and that time belongs in the scope. The agent adds a first pass to their week and leaves the decisions with them. For how an agent differs from the AI tools you may already use, see AI agents vs AI tools.
Five checks before you scope an agent
- Confirm every spreadsheet the workflow edits is an Office Open XML workbook (such as an .xlsx file) in OneDrive for Business, SharePoint or a Group drive.
- Confirm the permission each connection needs, and write down the reason for any that is not the lowest.
- List which steps write to a system, and require a person's approval on each.
- Name where the official record lives and confirm it stays there.
- Name the person on your team who owns the agent once it runs.
Bring these five checks to the AI Workflow Assessment, and the scope starts from your actual setup.