How it works
Inside your own Microsoft 365, on Microsoft's cloud
No black box. Here is exactly how our automations connect to your Microsoft 365, what they are allowed to touch, where data goes, and which recorded activities you can review.
Provider roles and processing locations are listed on the subprocessors page. Read the privacy policy for operational records, retention, and deletion.
The path, step by step
- 1
Your Microsoft 365 tenant
Your Outlook, OneDrive, SharePoint and Teams — your data, in your name. Microsoft calls this your tenant; it just means your company's own copy of Microsoft 365.
- 2
Admin consent in your own tenant
You consent to a named ID360 application in your own Microsoft 365 admin center, and you can withdraw it at any time. We never hold a standing password to your tenant. Be clear about the limit, because it is easy to overstate: the permissions the application holds are tenant-wide, not confined to the mailboxes and sites you nominate. Pointing the automations at only those is our configuration choice, not a boundary Microsoft enforces on us. The terms set out how wide the access is, and the ApplicationAccessPolicy you can apply in your own tenant to narrow the Exchange half of it.
- 3
Microsoft Graph
Every automation talks to your tenant through Microsoft Graph. There is one fixed set of five application permissions for all of them — a workflow does not get its own narrower grant.
- 4
Azure Functions + Logic Apps
The automation logic runs on Microsoft's own cloud — event-driven Functions and Logic Apps we build and operate.
- 5
AI processing by feature
AI steps send prompt content to the provider assigned to the feature. The provider catalog lists Google Gemini for the storefront assistant, logo prompts, and content tools; Qwen through Vercel AI Gateway for website generation/refinement and video planning/editorial processing, requiring zero-data-retention-capable routing; and Higgsfield/Seedance for video visuals. Azure provides video narration, rendering, and private media storage. These documented routes do not establish verified live API availability or US-only processing; see /trust/subprocessors.
- 6
Back to your apps
Microsoft 365 workflow results land in your tenant. Extracted operational details, run history, and usage records also live in ID360's Azure PostgreSQL database in the United States. They can contain personal data such as invoice details and mailbox addresses, separate from the original mail and files. Account and saved-project records use Firebase; private video assets and drafts use Azure storage. Storage location does not establish the location of upstream provider processing. See /privacy for retention and deletion.
The permissions we hold
Five permissions, tenant-wide, the same for every customer
This is the complete set, and it is the same for every customer — it is not assembled per tenant and buying fewer automations does not shrink it. These are application permissions, so they are tenant-wide rather than limited to the mailboxes and sites you nominate; we point the automations only at those, but that is our configuration, not a boundary Microsoft enforces on us. Microsoft's own consent screen is the authoritative statement of what you are granting.
Mail.ReadWriteRead the mail an automation is built to handle, file its attachments, and leave a drafted reply in Drafts. Tenant-wide: it reaches every mailbox in your tenant, not only the one an automation points at.
Mail.SendSend the message an automation composes — a morning brief, a meeting prep note, an acknowledgement. Tenant-wide: it can send as any mailbox in your tenant.
Calendars.ReadRead today's meetings so a brief can list them. Read only — we cannot create, move, or cancel anything in a calendar.
Sites.ReadWrite.AllFile documents into the SharePoint library an automation is configured for. This is the broadest permission we hold: it reaches every SharePoint site in your tenant, and there is no per-site restriction on it today.
User.Read.AllResolve who owns what, so a notification reaches the right person and a filed document is attributed correctly. Read only — we cannot create, change, or disable an account.
Original content and operational records
Original mail and documents remain in your Microsoft 365 tenant. Automations read and write there and store extracted operational details in our Azure PostgreSQL database. AI steps send prompt content to the provider assigned to that feature.
Consented, revocable access
The permissions are tenant-wide, not scoped to what you nominate, and the consent does not run on a timer — it lasts until you withdraw it. You can review it, and revoke it, in your own admin center at any time. Blocking the application prevents new access tokens, but existing tokens may remain valid until they expire. Contact operators through support to suspend jobs and confirm access has stopped.
Partial customer activity views
Sign in to review managed automation activity and mailbox creation and removal activity. These views are not a complete cross-product audit trail or a record of every access. Ask support for help with other records.
Questions about the architecture?
Bring them to the setup call — we're happy to walk through the scopes and the audit log line by line.