# What the Admin Center can do in your tenant

> What the MailConnect Admin Center can read and change in your Microsoft 365 when someone signs in to it: the app it uses, every read, the writes and the log.

Source: https://getmailconnect.com/docs/security/admin-center-in-your-tenant/

The [MailConnect Admin Center](https://getmailconnect.com/docs/getting-started/admin-center.md) is a website.
On its own, it reaches nothing in your tenant. It only reaches your Microsoft 365
when one of the people who may change your MailConnect settings signs in to your
tenant from its **Settings** tab, to pick SharePoint lists for tabs, or to pick or
create content types. This page lists everything that sign-in can do. How it looks
to the person signing in is under
[Signing in to your Microsoft 365](https://getmailconnect.com/docs/admin-center/connect.md).

## Who can sign in

The people who may change your MailConnect settings: your own Admins, your
partner's Owners and Managers, and Pinksky ApS. They need
an account in your tenant, as a member or a guest. Accounts in other tenants are
refused, by Microsoft and again by the Admin Center. Each person reaches only what
their own account can reach in SharePoint.

## The app it uses

The sign-in uses the MailConnect app you approved during installation,
**MailConnect - Outlook App**
(`3f3efb36-9b20-4641-a356-9a9a0ee9f0da`), not the Admin Center's own app.
Nothing new is approved: the Admin Center asks only for permissions the app already
has. If Microsoft asks for consent anyway, MailConnect isn't set up in that tenant:
the Admin Center tells the person to cancel, and says that nothing was granted.

Microsoft issues the sign-in's token with all of the app's delegated permissions
(see [Permissions](https://getmailconnect.com/docs/security/permissions.md#mailconnect-app)), so the limits
below are enforced by the Admin Center itself:

- **The token stays in the browser's memory.** It's never sent to Pinksky's servers, only to Microsoft Graph (`graph.microsoft.com`). It's forgotten when the person disconnects, opens another organisation, reloads or closes the tab.
- **Reads go through a client that only sends GET requests**, with one exception: a Microsoft Search request, which uses POST but changes nothing.
- **Writes go through a separate allow-list**, and only on your Content Type Hub site.

## What it reads

GET requests only, in the browser:

| When | What's read |
|------|-------------|
| Signing in | The signed-in account (`/me`), your SharePoint's root site, and the Content Type Hub with its content types. |
| Setting up Fill SharePoint columns | The Content Type Hub's content types, and a content type's columns. Re-checking also reads one content type by its ID, and whether it's published. |
| Setting up a tab | Sites matching a search (OneDrive sites left out), a site from a pasted link, a site's lists (hidden ones left out) and document libraries, and a list's columns. |
| Previewing a tab | A tab's first 50 locations, read with MailConnect's own query. For a tab that hides what people can't open, a check of each location's site. The signed-in account's followed sites, and sites matching a search. |
| Previewing search when writing | One Microsoft Search request (`POST search/query`): files, libraries and sites in your SharePoint, up to 150 results, as MailConnect searches in Outlook. |

Nothing read is sent to or stored by Pinksky ApS. Only what
the person saves is: for example a tab's site, list and column names, or the
content type IDs and column names for Fill SharePoint columns.

## What it can change

Only MailConnect's own content types and columns in your Content Type Hub, and only
when someone selects **Create MailConnect's content types…** or
**Remove MailConnect's content types…** and confirms. This uses the MailConnect
app's `Sites.Manage.All`, which is already approved. Before anything is sent, the
browser checks each request against an allow-list on the hub's site:

- create site columns and content types;
- add columns to a content type, and publish or unpublish it;
- change a content type (to hide it from the **New** menu) or delete it, and delete a column.

Anything else is refused. Creating them needs a SharePoint admin, or an owner of
the Content Type Hub. Removing takes out only what MailConnect created: its column
group, its columns, and its three content types. Each step is shown to the person
as it happens. The content types themselves are described under
[Filling SharePoint columns](https://getmailconnect.com/docs/admin-center/sharepoint-columns.md#using-mailconnects-content-types).

## Checking a custom endpoint

Your partner's Owners and Managers, and Pinksky, can check what a custom endpoint
tab returns, with **Check the endpoint…**. Such a tab gets its locations from your
partner's own system, for example an Azure Logic App. It's the only time the Admin Center sends a token
anywhere other than Microsoft:

- **It asks first**, naming the account and the endpoint's host: *Sends a SharePoint token for {account} to {host}. With it, the endpoint can read SharePoint as {account} for up to an hour.*
- **It sends one SharePoint token** for the signed-in account, in the headers the tab names. Never a Microsoft Graph token: a Graph token from the MailConnect app could reach the person's mail.
- **It's sent from a separate, sandboxed page** with no access to the Admin Center, its storage or its sign-in: one GET request, without cookies, for at most 20 seconds.
- **Customers' own Admins never check endpoints**, and never see an endpoint's full address.

## Every action is logged

Each of these is recorded in Pinksky's audit log:

| Action | What's recorded |
|--------|-----------------|
| Signing in to your tenant | Who did it in the Admin Center, your organisation, the account used, whether it was a guest, and whether each read worked. It's recorded before anything read is shown: if it can't be, the connection ends. |
| Creating or removing MailConnect's content types | The same, with each step and how it went. |
| Checking a custom endpoint | The account used, whether it was a guest, the endpoint's host and the header names. Never the address, which can carry the endpoint's key, and never the token. It's recorded before anything is sent: if it can't be, nothing is sent. |

Questions? Contact [support@getmailconnect.com](mailto:support@getmailconnect.com).