# Permissions

> Every permission MailConnect asks for: the two Microsoft Entra apps approved at install, the Outlook add-in manifest, and the Admin Center's own app.

Source: https://getmailconnect.com/docs/security/permissions/

During [installation](https://getmailconnect.com/docs/getting-started/installation.md) you approve two Microsoft Entra apps
and deploy one Outlook add-in. The [Admin Center](https://getmailconnect.com/docs/getting-started/admin-center.md)
has a third app of its own, approved when people first sign in to it. This page
lists everything each of them is allowed to do.

The two apps from the install are kept separate, so that the licence count and the
add-in's own access stay apart. All three apps are published by
Pinksky ApS and are listed in Entra ID under
**Enterprise applications** after approval.

## Licence checker

| | |
|-|-|
| Name | MailConnect - License verification app |
| Application (client) ID | 4226dac1-a444-4207-a30f-10db8428e13f |
| Permission type | **Application** |


| Permission | What it's used for |
|---|---|
| `LicenseAssignment.Read.All` | Lets the checker see which Microsoft licenses exist in your tenant. |
| `User.Read.All` | Lets the checker read which users have assigned licenses. |


These are application permissions: the checker runs on its own, without a signed-in
user, so it can count licences in the background. Of what it reads, we keep only
the **total number** of licensed users in your tenant, never who they are or which
licences they have.

## MailConnect app

| | |
|-|-|
| Name | MailConnect - Outlook App |
| Application (client) ID | 3f3efb36-9b20-4641-a356-9a9a0ee9f0da |
| Permission type | **Delegated** |


| Permission | What it's used for |
|---|---|
| `Files.ReadWrite.AppFolder` | Read & write files in a dedicated app folder in the user's OneDrive, used only to store that user's own MailConnect settings. |
| `Mail.ReadWrite.Shared` | Read & write shared mailboxes on the user's behalf. |
| `profile` | Access the user's profile information. |
| `Sites.Manage.All` | Create, edit and delete lists and list items across the SharePoint sites the user already has access to. |
| `Sites.ReadWrite.All` | Read & write across the SharePoint sites the user already has access to. |
| `TermStore.Read.All` | Read the managed metadata term store, so MailConnect can offer the right choices in managed metadata columns. |
| `User.Read` | Access the user's basic profile information. |


These are delegated permissions: MailConnect always acts **as the signed-in user**,
on top of that user's own access. Even though some permission names end in `.All`,
the add-in can never reach a site, list or mailbox the user couldn't already open
themselves. Your existing SharePoint and Exchange permissions remain the boundary.

`Files.ReadWrite.AppFolder` is limited to a dedicated MailConnect folder in
each user's own OneDrive, where that user's MailConnect settings are stored. It
gives no access to the rest of their OneDrive.

The Admin Center uses this app too, when one of the people who may change your
settings signs in to your tenant from it, to pick SharePoint lists or content
types. Nothing new is approved for that. What it may do is listed under
[What the Admin Center can do in your tenant](https://getmailconnect.com/docs/security/admin-center-in-your-tenant.md).

## The Outlook add-in

The [manifest](https://getmailconnect.com/mailconnect/manifest.xml) you upload during installation tells
Outlook where MailConnect appears and what it may do with the open item. You can
review it before uploading.

| | |
|-|-|
| Mailbox permission | `ReadWriteMailbox` |
| Requirement set | Mailbox 1.5 or later |
| Shared mailboxes | Supported |
| Appears in | Reading and composing mail, meetings you organise, and Outlook mobile (reading mail) |
| Runs when | A user opens it from the ribbon, or a new message is composed (a launch event) |
| Served from | `mailconnect.tenantapps.cloud` |

`ReadWriteMailbox` lets the add-in read and change items in the user's mailbox.
As with the Entra app, it never reaches beyond what the user's own mailbox access
allows.

## Admin Center

The [MailConnect Admin Center](https://getmailconnect.com/docs/getting-started/admin-center.md) signs people
in with its own app. It isn't part of the install: it's approved the first time
someone from your organisation signs in to the Admin Center.

| | |
|-|-|
| Name | MailConnect Admin Center |
| Application (client) ID | 34205f5e-6878-4beb-9257-8698dccba83b |
| Permission type | **Delegated** |

| Permission | What it's used for |
|------------|--------------------|
| `access_as_user` | Lets the portal call its own API as you, so it knows who is signed in. |
| `User.Read` (Microsoft Graph) | Shows your own profile photo in the portal. Fetched in your browser only. |

Users can normally consent to this themselves at first sign-in. If your tenant
blocks user consent, an admin can approve it once for everyone:
[approve the Admin Center](https://login.microsoftonline.com/organizations/adminconsent?client_id=34205f5e-6878-4beb-9257-8698dccba83b).

This app gives Pinksky ApS no access to your tenant. When
the Admin Center reaches your SharePoint, it does so through the MailConnect app
above, as the person signed in: see
[What the Admin Center can do in your tenant](https://getmailconnect.com/docs/security/admin-center-in-your-tenant.md).

## Removing access

To withdraw consent, open **Entra ID → Enterprise applications**, find the app
by name or application ID, and delete it. Deleting the MailConnect app stops the
add-in from working, and the Admin Center from reaching your tenant. Deleting the
MailConnect Admin Center app withdraws the consent people gave it when they signed
in to the Admin Center. To remove MailConnect completely, see
[Uninstalling](https://getmailconnect.com/docs/getting-started/installation.md#uninstalling).

Questions? Contact [support@getmailconnect.com](mailto:support@getmailconnect.com).