Websites, automation, and Microsoft 365 systems
for growing businesses.

The busywork, done before you open your laptop

Invoices arrive in a monitored mailbox and get filed to SharePoint under vendor and date. Enquiries get triaged and routed to the right person, with a first-draft reply left in Drafts for someone to read before it sends. Every weekday morning a brief lands in Outlook with your unread mail and the day's calendar already summarised.

What we will not build, and why

Our application holds Sites.ReadWrite.All, which is tenant-wide. The policy we recommend you apply in your own tenant covers Exchange only, so limiting our reach to the SharePoint sites you nominate is our configuration choice and nothing more.

So there is a category of thing we turn down: anything where one of your employees would read another employee's documents through our application. No company-wide document search, no HR or payroll library, no cross-department portal. Not because it is hard — because the app signs in as itself rather than as the person asking, so it cannot enforce who should see what.

That changes when Microsoft's per-site scoping or a sign-in-as-you flow is in place here. Until then we would rather turn the work down than build something that looks like it is working right up until the day it hands someone the wrong file.

One application, one fixed set of permissions

Your own administrator consents to a single named ID360 application from inside your own Microsoft admin center. There is no shared admin account and no password of yours in our hands.

The permissions are tenant-wide and identical for every customer: Mail.ReadWrite, Mail.Send, Calendars.Read, Sites.ReadWrite.All and User.Read.All. We point the automations only at the mailboxes and sites you nominate — that is our configuration choice, not a boundary Microsoft enforces on us. You can revoke from your own admin center at any time, without telling us first.