Connect Microsoft 365
One admin approval. Mail, calendar, Teams, and files, each read with the signed-in person's own access.
Updated August 2026
About ten minutes, once, for whoever administers Microsoft 365. You need the consent link the firm owner produces in the console's Connect panel, and nothing installs anywhere.
Step 1. Approve it on Microsoft's screen
Microsoft's own screen opens, titled "Permissions requested. Review for your organization". Read the list, then Accept. There is no checkbox: consent is organization-wide by construction.
Every permission is delegated and read-only, and every read carries the signed-in person's own access. Acting in Microsoft 365 is a separate consent, so this approval cannot become a write approval.
Step 2. There is no step 2
Approving switches nothing on. The connection goes live when the first person completes their own Microsoft work sign-in and one real read succeeds.
You're done
The owner sees it go live in the console. Nothing comes back to IT.
If something doesn't work
- Link expired before you opened it? The owner issues a single-use replacement from the same panel.
- Accepted, but nothing happened? A consent granted in the wrong tenant shows as a visible setup state, not a silent gap.
What IT is not asked to do
| Not asked | What is true instead |
|---|---|
| Install anything | Connect is hosted. Nothing is packaged or pushed onto anyone's computer. |
| Trust or distribute a certificate | None is created, and no certificate authority either. |
| Change the network | The path runs between the assistant, the firm's own Proxara environment, and Microsoft. Nothing listens inbound. |
| Store a credential | The assistant registers itself: no client ID, secret, or token to hold or rotate. |
| Grant an application permission | Every permission is delegated, and none of them writes. |
A change-advisory board that reviews device, network, or certificate changes will find none of the three here. It is one approval inside Entra.
The permissions, exactly as the screen shows them
Expect one bold line partway down: "This application is not published by Microsoft or your organization." Microsoft shows it for any application it did not publish and the firm did not register. Under the application name, a verified publisher renders as a name in blue with a solid blue badge and white check; an unverified application renders the literal word "unverified" instead.
The screen shows Microsoft's display names; the scope strings appear in the Entra admin center.
| What the screen renders | Scope | Why it is requested |
|---|---|---|
| Read user mail | Mail.Read | Client correspondence and attachments |
| Read user calendars | Calendars.Read | The meeting or deadline behind a request |
| Read user chat messages | Chat.Read | Teams conversations the employee is in |
| Read user channel messages | ChannelMessage.Read.All | Team channels the employee belongs to |
| Read all files that user can access | Files.Read.All | OneDrive and SharePoint documents |
| Read user's tasks and task lists | Tasks.Read | To Do and Planner items |
| Sign in and read user profile | User.Read | Knowing which employee is asking |
| View users' basic profile | profile | The employee's name, for attribution |
| Sign users in | openid | The standard sign-in permission |
| Not rendered as a row | offline_access | Renewal, so nobody signs in every time |
ChannelMessage.Read.All is the one Microsoft flags as requiring administrator consent, and that single flag is why an administrator is involved at all. The screen may draw fewer rows than there are scopes: profile is often folded into User.Read.
Where it appears afterwards, and how to take it back out
View, filter, and search applications in your organization that are set up to use your Microsoft Entra tenant as their Identity Provider.
The list of applications that are maintained by your organization are in application registrations.
Below is the list of permissions that have been granted for your organization. As an administrator, you can grant permissions to this app on behalf of all users (delegated permissions). You can also grant permissions directly to this app (app permissions). Learn more.
You can review, revoke, and restore permissions. Learn more.
To configure requested permissions for apps you own, use the app registration.
In the Microsoft Entra admin center: Entra ID, then Enterprise apps, then All applications.
| To do this | Go here |
|---|---|
| See exactly what is granted | The application's Permissions page, under Security |
| Revoke one permission | The row's "..." menu, then Revoke Permission |
| Restrict who may use it | Properties, set "Assignment required?" to Yes, then assign people under Users and groups |
| Stop sign-in entirely | Properties, set "Enabled for users to sign-in?" to No |
| Remove it altogether | Properties, then Delete, then Yes to confirm |
Proxara does not poll Microsoft. It uses a stored access token until that token nears expiry, and withdraws a person's access the first time Microsoft refuses a renewal or a read, so a change made in Entra takes effect on the next use. The immediate stop is the owner's own switch in the console: Ending access.
Closing user consent for everything else
Control when end users and group owners are allowed to grant consent to applications, and when they will be required to request administrator review and approval. Allowing users to grant apps access to data helps them acquire useful applications and be productive, but can represent a risk in some situations if it's not monitored and controlled carefully.
Optional, and Connect works either way. Left open, an employee can grant an AI tool access to their own mailbox with nobody reviewing it. Closed, only sanctioned applications reach Microsoft Graph.
- Entra ID, then Enterprise apps, then Consent and permissions, then User consent settings.
- Under "User consent for applications", choose "Do not allow user consent".
- Save, from the command row at the top left of the pane.
On the neighbouring Admin consent settings page, turn off "Users can request admin consent to apps they are unable to consent to". An employee who tries one then sees "Need admin approval" and no way forward.
Where to go next
| To do this | Read |
|---|---|
| The next system | Connect Karbon |
| The whole rollout | What happens when you deploy |
| The one-page version for the approver | Proxara Connect for IT |