Microsoft Integrations: Permissions & Admin Approval
Understand Microsoft permission types, grant admin consent, and review what permissions ajan requires for Microsoft integrations.
This applies to the following integrations: Excel, Microsoft Teams, OneDrive, Outlook Calendar, Outlook Email, Planner, and SharePoint.
Understanding Permission Types
Microsoft uses two types of OAuth permissions:
| Type | Who Acts | When Used |
|---|---|---|
| Delegated | User on their own behalf | User is signed in. Actions happen as that user with their access rights. |
| Application | App on behalf of org | No user signed in. App has its own access (e.g., background jobs). |
Granting Admin Consent
A Microsoft admin must grant tenant-wide consent before users can connect Microsoft integrations.
Open Microsoft Entra
Sign in to the Microsoft Entra admin center as a Cloud Application Administrator or Global Administrator.
Find ajan
Go to Identity → Applications → Enterprise applications → All applications and select ajan.
Grant Consent
Under Security, select Permissions, then click Grant admin consent for \[Your Organization].
Verify in ajan
In ajan, go to Workspace settings → Integrations, select a Microsoft integration such as Outlook Calendar, and connect your account to confirm it works.
For more details, see Microsoft's documentation on granting tenant-wide admin consent.
Reviewing Granted Permissions
After granting consent, you can review all permissions in Microsoft Entra:
- Go to Identity → Applications → Enterprise applications → ajan
- Under Security, click Permissions
The Type column shows "Delegated" for all ajan permissions—confirming ajan only acts on behalf of signed-in users.
Viewing Required Permissions per Integration
Each Microsoft integration requires specific permissions (scopes). To see what a particular integration needs:
- In ajan, go to Workspace settings → Integrations
- Select the Microsoft integration, such as Outlook Calendar
- Scroll to Scopes and Action Access
- Open Scope view to review the required scopes
These scopes map directly to Microsoft Graph permissions.
Common Permissions
| Permission | What It Allows |
|---|---|
Calendars.ReadWrite | Read and create calendar events |
Mail.ReadWrite | Read and send emails |
Files.ReadWrite.All | Access OneDrive/SharePoint files |
User.Read | Read your basic profile |
offline_access | Maintain access without re-login |
Customizing Permissions
If your organization requires different scopes than ajan's defaults, you can configure your own OAuth client.
- Configure Custom OAuth Client — Set up your own OAuth application to control exactly which scopes are requested.