Trust
Microsoft 365 permissions
Last updated October 28, 2026
SimpleNewsletter365 signs in with Microsoft Entra and sends through Microsoft Graph. Every permission below is delegated: the app acts as the signed-in user and never has access beyond what that user can do. Consent is progressive. At sign-in we request identity only; mailbox permission is requested at your first send, and the import and group permissions only when you use those features.
| Permission | Type | Requested | Admin consent | Used for | Why not narrower |
|---|---|---|---|---|---|
openid, profile, email | Delegated | Sign-in | No | Identify you with Microsoft Entra: tenant ID, user object ID, email and display name. | These are the minimum OpenID Connect scopes for a sign-in. |
offline_access | Delegated | First send | No | Keep the mailbox grant refreshable so scheduled newsletters can send without you present. | Without it the grant expires and every scheduled send would need a person signed in. |
Mail.Send | Delegated | First send from your own mailbox | Not by default | Send each newsletter from your own mailbox through Microsoft Graph. | Sending as you is the product. There is no narrower permission that sends mail. |
Mail.ReadWrite | Delegated | With Mail.Send | Not by default | Create the outgoing message and monitor non-delivery reports (bounces) for your sends. | Reading bounces and writing the sent copy needs mailbox read and write access. |
Mail.Send.Shared, Mail.ReadWrite.Shared | Delegated | First send from a shared mailbox or alias | Not by default | The same as above, for a shared mailbox you can send from. Exchange Send As remains an administrator prerequisite. | The own-mailbox permissions do not cover mailboxes you only have delegated access to. |
Contacts.Read | Delegated | Only if you import Outlook contacts | Not by default | Read your personal Outlook contacts to import them into an audience. | There is no narrower contact permission. |
Files.Read | Delegated | Only if you import from OneDrive | Not by default | Browse and read the CSV or Excel contact file you choose in your OneDrive. | Reading a chosen file needs file read access to your OneDrive. |
Bookings.Read.All | Delegated | Only if you import Microsoft Bookings customers | Not by default | List Bookings calendars and read the customers of the one you select. | Bookings has no narrower read permission. |
GroupMember.Read.All, OrgContact.Read.All | Delegated | Only if you send to a Microsoft 365 group or distribution list | Yes | Read the members of a group or list you pick, resolved at send time. | Resolving transitive group members and external contacts needs these directory reads. |
User.ReadBasic.All | Delegated | With the group permissions above | No | Show the basic profile (name, email) of the group members you send to. | It is the narrowest permission that reads other users' basic profile. |
Admin consent
Users can usually consent to the mailbox permissions themselves. Tenants that restrict user consent need an administrator to approve the app once, and the group permissions (GroupMember.Read.All and OrgContact.Read.All) always need administrator approval. If Microsoft reports that administrator approval is required, ask your administrator to approve the app. See the IT admin guide.
Publisher verification
The regional mailbox apps (the apps that ask for the mail permissions above) do not yet have a verified publisher. On a tenant that uses Microsoft's default consent policy, an administrator therefore has to consent once before users can connect a mailbox. We use Microsoft Partner Network ID 7179688 (SimpleSoftware365) for publisher verification and will update this page when it is complete.
What we do not do
- Microsoft tokens stay on our servers and are never sent to your browser.
- Granting a later permission never removes an earlier one, and you can revoke access in your Microsoft account or tenant at any time.
- We do not request application permissions for customer tenants.