Permissions
During installation you approve two Microsoft Entra apps and deploy one Outlook add-in. The Admin Center has a third app of its own, approved when people first sign in to it. This page lists everything each of them is allowed to do.
The two apps from the install are kept separate, so that the licence count and the add-in’s own access stay apart. All three apps are published by Pinksky ApS and are listed in Entra ID under Enterprise applications after approval.
Licence checker
| Name | MailConnect - License verification app |
| Application (client) ID | 4226dac1-a444-4207-a30f-10db8428e13f |
| Permission type | Application |
| Permission | What it's used for |
|---|---|
LicenseAssignment.Read.All | Lets the checker see which Microsoft licenses exist in your tenant. |
User.Read.All | Lets the checker read which users have assigned licenses. |
These are application permissions: the checker runs on its own, without a signed-in user, so it can count licences in the background. Of what it reads, we keep only the total number of licensed users in your tenant, never who they are or which licences they have.
MailConnect app
| Name | MailConnect - Outlook App |
| Application (client) ID | 3f3efb36-9b20-4641-a356-9a9a0ee9f0da |
| Permission type | Delegated |
| Permission | What it's used for |
|---|---|
Files.ReadWrite.AppFolder | Read & write files in a dedicated app folder in the user's OneDrive, used only to store that user's own MailConnect settings. |
Mail.ReadWrite.Shared | Read & write shared mailboxes on the user's behalf. |
profile | Access the user's profile information. |
Sites.Manage.All | Create, edit and delete lists and list items across the SharePoint sites the user already has access to. |
Sites.ReadWrite.All | Read & write across the SharePoint sites the user already has access to. |
TermStore.Read.All | Read the managed metadata term store, so MailConnect can offer the right choices in managed metadata columns. |
User.Read | Access the user's basic profile information. |
These are delegated permissions: MailConnect always acts as the signed-in user,
on top of that user’s own access. Even though some permission names end in .All,
the add-in can never reach a site, list or mailbox the user couldn’t already open
themselves. Your existing SharePoint and Exchange permissions remain the boundary.
Files.ReadWrite.AppFolder is limited to a dedicated MailConnect folder in
each user’s own OneDrive, where that user’s MailConnect settings are stored. It
gives no access to the rest of their OneDrive.
The Admin Center uses this app too, when one of the people who may change your settings signs in to your tenant from it, to pick SharePoint lists or content types. Nothing new is approved for that. What it may do is listed under What the Admin Center can do in your tenant.
The Outlook add-in
The manifest you upload during installation tells Outlook where MailConnect appears and what it may do with the open item. You can review it before uploading.
| Mailbox permission | ReadWriteMailbox |
| Requirement set | Mailbox 1.5 or later |
| Shared mailboxes | Supported |
| Appears in | Reading and composing mail, meetings you organise, and Outlook mobile (reading mail) |
| Runs when | A user opens it from the ribbon, or a new message is composed (a launch event) |
| Served from | mailconnect.tenantapps.cloud |
ReadWriteMailbox lets the add-in read and change items in the user’s mailbox.
As with the Entra app, it never reaches beyond what the user’s own mailbox access
allows.
Admin Center
The MailConnect Admin Center signs people in with its own app. It isn’t part of the install: it’s approved the first time someone from your organisation signs in to the Admin Center.
| Name | MailConnect Admin Center |
| Application (client) ID | 34205f5e-6878-4beb-9257-8698dccba83b |
| Permission type | Delegated |
| Permission | What it’s used for |
|---|---|
access_as_user | Lets the portal call its own API as you, so it knows who is signed in. |
User.Read (Microsoft Graph) | Shows your own profile photo in the portal. Fetched in your browser only. |
Users can normally consent to this themselves at first sign-in. If your tenant blocks user consent, an admin can approve it once for everyone: approve the Admin Center.
This app gives Pinksky ApS no access to your tenant. When the Admin Center reaches your SharePoint, it does so through the MailConnect app above, as the person signed in: see What the Admin Center can do in your tenant.
Removing access
To withdraw consent, open Entra ID → Enterprise applications, find the app by name or application ID, and delete it. Deleting the MailConnect app stops the add-in from working, and the Admin Center from reaching your tenant. Deleting the MailConnect Admin Center app withdraws the consent people gave it when they signed in to the Admin Center. To remove MailConnect completely, see Uninstalling.
Questions? Contact [email protected].