Exchange mailboxes (on-premises server)
Connect your own Exchange Server to the Outpost: set up the account and its rights in Exchange, share it in the Outpost and use it in an assistant.
If you run Exchange Server in-house, an Outpost can read emails and calendar events there live and pass them to assistants. Nothing is copied or indexed in advance: the Outpost asks your server at the moment of the question, and each person reaches only their own mailbox.
The Outpost uses Exchange Web Services (EWS) and has been tested against Exchange Server Subscription Edition and Exchange Server 2019. Exchange Online (Microsoft 365) is a different route and not meant here — for that there is the Microsoft 365 connector.
Services are not generally available
Like all services, Exchange access appears only if the controlled services preview is enabled for your workspace. The three stations (Outpost, MeinGPT, assistant) are described in Services. This page adds what is specific to Exchange.
What assistants can do with it
You decide which of the five functions an assistant may use:
| Function | What it returns |
|---|---|
| List mail folders | The mail folders of the mailbox |
| Search messages | Matches in one folder, newest first, with a short preview (default 25, at most 250) |
| Read one message | The text of a mail; attachments are listed by name and size only, never opened |
| List calendar events | Events in a period of at most 92 days, recurring events expanded |
| Read one calendar event | One event with attendees and description |
Access is read-only. The Outpost cannot send, move or delete mail, or create events. Long text is cut off (mail text after 20,000 characters).
Emails are third-party text
Mails and events are written by others. The Outpost marks them to the model as untrusted so that instructions inside them are not followed. That is a layer of protection, not a free pass: do not give assistants with mailbox access tools that change things on their own.
Who sees which mailbox
The Outpost signs in to Exchange with one service account and acts on behalf of the person asking. Which mailbox that is depends on the email address of the MeinGPT account: it must match the primary address of the mailbox in Exchange. Nobody can request a different address — neither the assistant nor the person.
If a MeinGPT account has no matching address, the person gets no access rather than seeing the wrong mailbox.
In Exchange: set up the account and rights
Your Exchange administration does this once, in the Exchange Management Shell. The service account needs the ApplicationImpersonation role — and it must be restricted to the mailboxes the Outpost should read. Without a restriction it applies to every mailbox in the organisation.
Create the service account
Create a dedicated account with a mailbox that is used only for the Outpost, with a long random password that does not expire. Do not use a personal account.
Delimit the mailboxes
The management scope defines which mailboxes the Outpost may reach. A simple way is an attribute you set on the mailboxes concerned, here Department:
New-ManagementScope -Name OutpostMailboxes `
-RecipientRestrictionFilter { Department -eq 'MeinGPT' }Set the value on every mailbox the Outpost should read (Set-User anna.example -Department MeinGPT). Every other mailbox stays out of reach.
Assign the role
New-ManagementRoleAssignment -Name OutpostImpersonation `
-Role ApplicationImpersonation -User svc-outpost `
-CustomRecipientWriteScope OutpostMailboxesReplace svc-outpost with the name of your service account. The assignment can take a few minutes before Exchange applies it.
Check EWS and sign-in
EWS must be allowed for the account (Get-CASMailbox svc-outpost | Format-List EwsEnabled). The address is https://<server name>/EWS/Exchange.asmx. The Outpost signs in with NTLM, or with Basic if you enabled it on the server. Extended Protection for Authentication on the server is supported.
Kerberos alone is not enough yet
A server that rejects NTLM and allows only Kerberos is not served by this access yet. Keep NTLM allowed for EWS for the time being.
In the Outpost: share the mailboxes
Choose the service type
Shares tab → Share → Exchange mailboxes (on-premises).
Enter the connection
At the top of the Share Exchange mailboxes dialog is a short list of the prerequisites, with a link to this guide and the two PowerShell commands ready to copy. Then you enter:
- EWS address — the name of your Exchange server is enough, e.g.
mail.example.com. The Outpost adds the rest (/EWS/Exchange.asmx). An address with its own path stays as you typed it. - Sign-in method — NTLM or Basic.
- Domain, Service account and the Password (stored locally). The password is stored on this computer only, never reaches MeinGPT and is not shown again after saving.
- Server certificate to trust (optional) — needed only if this computer does not already trust your server's certificate, for example with an internal certificate authority. Paste it in PEM format. More under Your own root certificate (CA).
Test the connection
Test connection tries the details you have not saved yet and names the stage where it fails. Enter a mailbox under Mailbox to test (optional) that the account should be allowed to read: only this test proves that the ApplicationImpersonation role works. Without a mailbox, only the sign-in is tested.
| Message | Meaning and next step |
|---|---|
| Signed in and read the mailbox. | All good. |
| Signed in. No mailbox was tested. | Sign-in works; rights on mailboxes are still unchecked. |
| Sign-in failed. Check account name, domain and password. | Check the details. For Basic: is it enabled on the server? |
| Signed in, but the account may not read that mailbox. | Check the scope of the ApplicationImpersonation role: is the mailbox in it? |
| Signed in, but Exchange does not know that mailbox. | Check the address. |
| The server certificate is not trusted. Add it above. | Paste the issuing authority's certificate or install it on the computer. |
| The server name could not be found. / The server refused the connection. / The server did not answer in time. | Address, name resolution and the firewall between the Outpost computer and Exchange. |
| Exchange blocks EWS for this account by policy. | Allow EWS for the account. |
| Exchange is limiting requests right now. | Wait briefly and test again. |
Choose the functions
Under Functions released to assistants you check what assistants may use. At least one function is required. The last page summarises everything without showing the password.
After that it goes on in MeinGPT:
- Settings → Outposts → Manage → Shares: release access to people or teams — including yourself. A service that is not shared with you is not available to you in an assistant, not even as an admin.
- Settings → Connectors: switch the service on for the workspace. It is listed there with the connectors, next to mail and calendar services.
- Assistant editor → Tools → Connectors: activate the service for the assistant (note “via Outpost”).
Change and remove
An existing connection cannot be edited yet. To change the address, account or password, remove the service from the list of shares and create it again.
If it does not work
“Registered” and “reachable” are two states here too. Check connection in the Outpost console shows whether the server answers and offers the chosen sign-in method; it does not check the password, only Test connection in the dialog does. More under Check a database, MCP or HTTP share.
Under many simultaneous requests Exchange limits the load itself (with default settings from about 27 concurrent EWS connections per account). The Outpost keeps at most four connections open and waits when Exchange slows it down.