Outlook 2016 Addin

Question

I am trying to write an Outlook 2016 volume-licensed add-in that communicates with MS Dynamics 365 Version 9.1.

I am able to set up the add-in, however I always get permission denied if I try and call the Dynamics API e.G. (API-URL/contacts). According to https://learn.microsoft.com/en-us/power-apps/developer/data-platform/webapi/authenticate-web-api I should be authenticated. I do not know how this should be possible, nor how to get it to work.

My query looks like this:

let request = new XMLHttpRequest();
request.open('GET', config.APIUrl + "contacts");
request.setRequestHeader("OData-MaxVersion", "4.0");
request.setRequestHeader("OData-Version", "4.0");
request.setRequestHeader("Accept", "application/json");
request.setRequestHeader("Content-Type", "application/json; charset=utf-8");

request.onload = function (e) {
    if (this.status === 200) {
        //let data = JSON.parse(this.responseText);
        let data = this.responseText;
        renderResults(getMask(entity_type), data)
    }
}
request.send();

Note that Outlook 2016 volume-licensed uses IE 11 for its internal rendering :-(. https://learn.microsoft.com/en-us/office/dev/add-ins/concepts/browsers-used-by-office-web-add-ins

Thanks for any help and insights.

Best, Benedict

EDIT: I have now also tried basic auth:

request.setRequestHeader("Authorization", "Basic " + btoa(user + ":" + pw));

However, this did not work either.