Microsoft 365 Integration
The permission you grant once is the one nobody reviews again.
What is microsoft?
Microsoft 365 integration means connecting to mail, files, calendars and directory data through Microsoft interfaces, where the important decision is how much access the integration is granted, since consent is given once and rarely revisited.
Microsoft 365 holds most of what an organisation knows. Mail, documents, calendars and the directory of who works there. An integration reaching into it is reaching into nearly everything.
Permissions are granted through a consent step that somebody clicks once, and the difference between reading one mailbox and reading every mailbox in the tenant is a single scope nobody reads carefully at the time.
That consent is then rarely reviewed. Applications accumulate in a tenant with permissions granted years ago for projects that finished, and nobody removes them because nobody is looking.
Why we ask for less access
Duara integrates Microsoft 365 from Nairobi, and asks for the narrowest permissions that work rather than the ones that are convenient.
We request scoped access rather than tenant wide access. Broad consent is easier to obtain and easier to build against, and it means an application compromise reaches every mailbox in your organisation rather than one.
Who this is for
- Documents and data are moved by hand
- Calendars need connecting to other systems
- Mail needs processing into a business system
- Consented applications have accumulated in your tenant
Industries we serve
- Professional services
- Financial services
- Manufacturing
- Education
- Public sector
- Any organisation on Microsoft 365
Problems this solves
These are access and integration questions inside the system that holds most of what you know.
- Consent granted too broadly. The gap between one mailbox and every mailbox is a single scope, and nobody reads it carefully during a consent click.
- Applications nobody reviews. Consented applications accumulate for projects that finished, and their permissions remain because nobody is looking.
- Documents moved manually. Files are downloaded from SharePoint and uploaded elsewhere, which is slow and produces copies that diverge.
- Calendars disconnected from systems. Bookings live in one system and appointments in another, and somebody reconciles them by hand.
What we deliver
Narrowly scoped permissions, an assessment of what is already consented in your tenant, integration through Microsoft supported interfaces, and a review process so access does not accumulate.
Integration with the narrowest workable permissions
An assessment of applications already consented
Mail, file and calendar connection to your systems
A record of what was granted and why
A review process so access does not accumulate
Documentation your IT team can act on
Features
- Narrowest permissions that work. Broad consent is easier to obtain and means a compromise reaches every mailbox rather than one.
- Existing consents reviewed. Applications granted access years ago for finished projects are usually still there, and finding them is frequently the most valuable output.
- Scoped rather than tenant wide. Access limited to the specific mailboxes, sites or calendars needed rather than everything available.
- A record of what and why. What each permission is for, so a future review can decide rather than guess.
- Supported interfaces only. Microsoft published interfaces rather than anything that could change without notice.
Benefits
- Exposure stays proportionate. Narrow permissions mean an application problem is contained rather than organisation wide.
- Old access gets removed. Reviewing consented applications usually finds permissions nobody intended to still be granted.
- Manual file movement stops. Documents flow between systems without somebody downloading and reuploading them.
- Calendars and systems agree. Appointments in one place rather than reconciled by hand between two.
Technologies we use
- Microsoft Graph integration. Connecting to mail, files, calendars and directory through the supported interface.
- Permission scoping. Requesting access to specific resources rather than tenant wide equivalents.
- Consent review. Assessing what applications already hold in your tenant and what they are still for.
- SharePoint and OneDrive integration. Moving documents between Microsoft storage and your other systems.
- Calendar synchronisation. Connecting bookings and appointments between systems without manual reconciliation.
Consent is a single moment and the permission lasts indefinitely. That asymmetry is why the scope requested matters far more than it appears to at the time it is granted.
How the process works, step by step
Microsoft 365 integration usually takes two to five weeks, and the permission conversation happens with your IT team before anything is requested.
-
Step 1
Free tenant review
We look at what applications already hold access and what your integration would genuinely need.
-
Step 2
Permissions agreed with IT
The narrowest workable scope is agreed with whoever administers the tenant rather than requested and clicked.
-
Step 3
Built on supported interfaces
Integration uses Microsoft published routes so it survives platform change.
-
Step 4
Documented for review
What was granted and why, so a future review can decide rather than guess.
-
Step 5
Review process agreed
How consented applications get revisited, since accumulation is the problem that grows quietly.
Quality assurance and how we work
The commitments attached to access into the system holding most of your information.
- We request the narrowest permissions that work. Broad consent is easier for us and means an application compromise reaches every mailbox rather than one.
- We review what is already consented. Applications granted access for finished projects are usually still there, and finding them is often worth more than the integration.
- Permissions are agreed with your IT team. A consent click by somebody who did not read the scope is how tenant wide access gets granted accidentally.
- We document what each permission is for. A future review can then decide rather than guess, which is what makes review possible at all.
- We use supported interfaces only. Anything relying on undocumented behaviour breaks at a platform update you did not control.
Frequently asked questions about microsoft
What is the main risk here?
Over broad consent. The gap between reading one mailbox and every mailbox in the tenant is a single scope nobody reads carefully at the time.
Why does that matter later?
Because consent is a single moment and the permission lasts indefinitely. Nobody revisits it, so the exposure persists long after the project ends.
Do you request tenant wide access?
No, the narrowest that works. Broad consent is easier for us to build against and it means a compromise reaches everything.
Can you review what we have already consented?
Yes, and it is frequently the most valuable part. Applications granted access for finished projects are usually still there.
Who should agree the permissions?
Your IT administrator. A consent click by somebody who did not read the scope is how tenant wide access gets granted by accident.
Can it read email into another system?
Yes, scoped to the specific mailboxes needed rather than to everything, which is the difference that matters.
Can it work with SharePoint documents?
Yes, moving files between Microsoft storage and your other systems without somebody downloading and reuploading them.
Does it handle calendars?
Yes, connecting bookings and appointments between systems so nobody reconciles two calendars by hand.
Is Teams part of this?
Related but distinct enough that we treat it separately, since the useful integrations there are about conversation rather than data.
How long before the tenant is connected?
Two to five weeks, with the permission conversation happening with your IT team before anything is requested.
Will it survive Microsoft updates?
Built on supported interfaces, largely. Anything relying on undocumented behaviour breaks at an update you did not control.
Can we revoke access later?
Yes, from your own tenant administration at any time, which is one reason to keep the permission list documented.
What if our IT is outsourced?
They should be in the permission conversation. An integration granted access without their knowledge creates a problem for them rather than for us.
Does data leave Microsoft?
Only what the integration is designed to move, and we scope that deliberately rather than copying more than is needed.
Can it connect to Dynamics?
Yes, though Dynamics is effectively a separate platform with its own considerations and we would scope it as its own piece of work.
Will it work with older on premise Exchange?
Sometimes, with different interfaces and real limits, and we would establish what exists rather than assuming a cloud tenant.
Can it automate document approvals?
Yes, though where Microsoft own workflow tools would do the job we would say so rather than building alongside them.
Does it need a licence?
Some integration approaches consume licences and some do not, and we would tell you which before building rather than after.
Who can see what the integration accesses?
Your administrators, through tenant audit logging, which we would recommend keeping enabled.
What does a Microsoft 365 integration cost?
Scope and permission complexity determine it, quoted after the tenant review.
Glossary of terms
Microsoft 365 terms in plain language.
- Tenant
- Your organisation Microsoft 365 environment, including every mailbox and site in it.
- Consent
- The moment permission is granted to an application, which lasts indefinitely afterwards.
- Scope
- What a permission actually covers, where the difference between one mailbox and all of them is a single word.
- Microsoft Graph
- The supported interface for reaching mail, files, calendars and directory data.
- Application permission
- Access held by an application itself rather than on behalf of a signed in user.
- Consent review
- Revisiting what applications hold access, which rarely happens without a process.
Related services in Integrations
Talk to us about microsoft
Ask your IT administrator to list applications with consented access to your tenant. The list is usually longer than expected.
Start your project