New article
Recently updated
Understanding required permissions
Who is this article for?
Users who want to understand the required permissions for Enterprise.
No elevated permissions are required.
This article explains the permissions required to use OnePlace Solutions products with Microsoft 365.
1. Sign in with Microsoft 365
Mail Manager Enterprise uses modern authentication for secure access to Microsoft 365. When signing in for the first time, users must consent to user-based security permissions. This consent is required to use the software.
2. Applying permissions on behalf of users
M365 Administrators can simplify onboarding by applying the Azure permissions on behalf of users. This prevents consent prompts during first use.
If both desktop and app versions are installed, select both links to apply permissions.
- Click here for Ideagen Mail Manager (Enterprise) Desktop consent
- Click here for Ideagen Mail Manager (Enterprise) App consent
3. Desktop permissions
Product: Ideagen Mail Manager Desktop Suite — the Outlook, Word, Excel and PowerPoint add-ins, and the Administration Client.
Microsoft Graph
| API / Permission name | Type | Description | Admin consent required | Why it's needed |
|---|---|---|---|---|
| openid | Delegated | Sign users in | No | Standard sign-in |
| profile | Delegated | View users' basic profile | No | Standard sign-in |
| offline_access | Delegated | Maintain access to data already granted | No | Keeps the user signed in across sessions without repeated re-authentication |
| User.Read | Delegated | Sign in and read user profile | No | Shows the signed-in user's name and photo; supports trial and licensing sign-up |
| User.ReadWrite | Delegated | Read and write user profile | No | Stores per-user roaming settings so preferences follow the user across machines |
| Team.ReadBasic.All | Delegated | Read team names and descriptions | No | Lets users browse joined Teams and pick one as a save location |
| Channel.ReadBasic.All | Delegated | Read channel names and descriptions | No | Lets users browse channels and pick a channel's file library as a save destination |
| Files.ReadWrite.All | Delegated | Full access to files the user can access | No | Browses and saves files to OneDrive/SharePoint via Graph, including PDF conversion of saved documents |
SharePoint Online API
This is a separate resource from Microsoft Graph.
| API / Permission name | Type | Description | Admin consent required | Why it's needed |
|---|---|---|---|---|
| AllSites.Manage | Delegated | Read and write items and lists in all site collections | No (default, suite-wide) | Baseline access for saving email and documents to SharePoint: creating and editing list items, uploading documents, applying metadata |
| AllSites.FullControl | Delegated | Full control of all site collections | Yes | Only used by the Administration Client, only when applying the OnePlace Solutions provisioning template |
| TermStore.ReadWrite.All | Delegated | Read and write managed metadata | Yes | Only used when a user creates a new taxonomy term from the metadata entry picker |
Custom API
| API / Permission name | Type | Description | Admin consent required | Why it's needed |
|---|---|---|---|---|
| api://{Mail Manager API}/access_as_user | Delegated | Access the Ideagen Mail Manager licensing API as the signed-in user | No | Validates the product licence against Ideagen's own licensing backend |
4. App permissions
The Mail App also uses delegated permissions. Below are the required permissions and their purposes:
Microsoft Graph
| API / Permission name | Type | Description | Admin consent required | Why it's needed | |
|---|---|---|---|---|---|
| openid | Delegated | Sign users in | No | Standard sign-in | |
| offline_access | Delegated | Maintain access to data already granted | No | Keeps the user signed in across sessions | |
| User.Read | Delegated | Sign in and read user profile | No | Signed-in user identity | |
| User.ReadWrite | Delegated | Read and write user profile | No | Stores per-user settings | |
| User.ReadBasic.All | Delegated | Read all users' basic profiles | No | Resolves display names and photos for people pickers, e.g. showing who saved an item | |
| Mail.ReadWrite.Shared | Delegated | Read and write user and shared mail | No | Reads the email being saved and writes back category metadata afterwards, including shared or delegated mailboxes | |
| MailboxSettings.ReadWrite | Delegated | Read and write user mailbox settings | No | Maintains an Outlook master category (e.g. "Saved") so users see which emails have been filed | |
| Sites.ReadWrite.All | Delegated | Edit or delete items in all site collections | No | Creates and updates SharePoint list items and uploads attachments as part of saving; also powers search in the web app | |
| Team.ReadBasic.All | Delegated | Read team names and descriptions | No | Lets users pick a Teams channel as a save destination | |
| Channel.ReadBasic.All | Delegated | Read channel names and descriptions | No | Channel picker for saving to Teams | |
| ChannelMessage.Send | Delegated | Send channel messages | No | Posts a notification in the chosen Teams channel after an item is saved there | |
| GroupMember.Read.All | Delegated | Read group memberships | Yes | Supports @mention autocomplete against full team membership. Requested behind a separate "enable admin consent" action, not at first sign-in | |
SharePoint Online API
| API / Permission name | Type | Description | Admin consent required | Why it's needed |
|---|---|---|---|---|
| AllSites.Manage | Delegated | Read and write items and lists in all site collections | No | Classic SharePoint operations underpinning the same save-to-SharePoint feature |
Office Add-in permission
This isn't an OAuth or Graph scope. It's Outlook's own add-in permission model, listed here in the same column layout for consistency.
| API / Permission name | Type | Description | Admin consent required | Why it's needed |
|---|---|---|---|---|
| ReadWriteMailbox | Add-in permission | Grants read/write access to the currently selected Outlook item | No (consented once at add-in install) | Lets the add-in read the email or attachment being saved and interact with it |
Teams permissions used: Team.ReadBasic.All, Channel.ReadBasic.All, ChannelMessage.Send. The only App permission requiring admin consent is GroupMember.Read.All.
5. Administrative permissions for creating the Admin site
The Administration Client doesn't create a SharePoint site collection — it applies a configuration template to a site that already exists. The table below reflects the permission this actually uses, under its correct technical name.
| API / Permission name | Type | Description | Admin consent required | Why it's needed |
|---|---|---|---|---|
| AllSites.FullControl | Delegated | Full control of all site collections | Yes | Used only by the Administration Client, only when applying the OnePlace Solutions provisioning template |
What SharePoint access level does the admin user need?
To run the Administration Client, users must have Site Owner or Full Control on the target site, preferably as Site Collection Administrator. The tool breaks role inheritance, granting Full Control to site admins and owners during provisioning, with configuration list management limited to Site Owners.
Site collection creation is a prerequisite done outside the app, requiring SharePoint Administrator or equivalent tenant site-creation rights. A Global Administrator role is not needed.
6. Saffron: tenancy-level email tracking service permissions
Product: Saffron, the Email Tracking and Automation Service, deployed as an Azure Functions app into the customer's own tenant via Marketplace.
Microsoft Graph (application permissions)
| API / Permission name | Type | Description | Admin consent required | Why it's needed |
|---|---|---|---|---|
| Mail.ReadWrite | Application | Read and write mail in all mailboxes, no signed-in user | Yes | Reads and updates tracked emails across whichever recipient mailboxes they land in |
| User.Read.All | Application | Read all users' full profiles | Yes | Resolves email addresses for members of distribution and security groups referenced in tracking and automation configuration |
| GroupMember.Read.All | Application | Read all group memberships, no signed-in user | Yes | Expands group membership, so a rule such as "track emails sent to the Finance group" can apply to each member individually |
| MailboxSettings.Read | Application | Read all users' mailbox settings | Yes | Used during setup to validate a target mailbox and read categories relevant to tracking status |
Setup requirements
Setting up Saffron needs an account able to create an Azure AD app registration and grant tenant-wide admin consent for the permissions listed. Usually, this means a Global Administrator, Privileged Role Administrator, or Application/Cloud Application Administrator with consent rights. Additionally, Azure subscription Owner or Contributor access is required to deploy Marketplace resources.