Microsoft 365 permissions
This page is for the person being asked to approve Daslab in a Microsoft 365 tenant. It lists every permission we request, in plain language, and the ones we deliberately don't.
The general model is in Auth & permissions: Daslab calls Microsoft as you, never as a shared service account. Everything below inherits from that.
One app, one grant
Teams, Outlook, OneDrive, SharePoint and Power BI are five integrations but one Microsoft Entra application. A single admin consent covers all of them. You are not approving five things, and connecting a second one later does not come back for another grant.
Each user still connects individually. Admin consent authorizes the application for the tenant; it does not connect anyone's account or move any data on its own.
What each integration asks for
Every permission below is delegated — scoped to the person who connects. "All" in a Microsoft permission name means all the ones this user can already open, not everything in the organization.
| Integration | Permissions | In plain language |
|---|---|---|
| Teams | Team.ReadBasic.All, Channel.ReadBasic.All, ChannelMessage.Read.All, ChannelMessage.Send | Read the teams and channels this user belongs to, read messages and replies in them, post messages |
| Outlook | Mail.Read, Mail.Send, Calendars.ReadWrite, Contacts.Read | Read this user's mail, send as them, read and write their calendar, read their contacts |
| OneDrive | Files.ReadWrite.All | Read and write files this user can already reach |
| SharePoint | Sites.Read.All, Files.Read.All | Read sites, document libraries and files this user can already reach |
| Power BI | Workspace.Read.All, Dataset.Read.All, Report.Read.All, Dashboard.Read.All | List workspaces, reports and dashboards this user can see, and run read-only DAX queries against their semantic models |
All five also request openid, profile, email, User.Read and offline_access — sign-in, the connecting user's name and address, and a refresh token so the connection survives past an hour.
What we deliberately do not ask for
Tenant.Read.All (Power BI). This is the read-every-workspace-in-the-organization permission. We don't request it. Power BI access is bounded by the connecting user's own workspace memberships.
Any Chat permission (Teams). Teams splits conversations in two: channels, which live inside a team, and chats — the Chat pane, covering 1:1, group and meeting conversations. We request channel permissions only.
Daslab cannot read Teams chats. Not through a tool, and not through search: message search is bounded by the same permissions, so it returns channel messages only. If you need an agent involved in a conversation, put it in a channel.
Private channels behave the way you'd expect from the permission model: if the connecting user is a member of a private channel, Daslab reads it like any other channel. If they aren't, it isn't listed and its messages aren't reachable.
Writes are gated
Four of these permissions can change something: posting or replying in a Teams channel, sending mail as the user, creating calendar events, and uploading files or creating folders in OneDrive. Every one of those actions pauses for human approval before it runs, and the approval shows the exact content. Read operations run without interruption.
SharePoint and Power BI are read-only in both directions — we request no write permission and ship no write tool.
Granting it
A Global Administrator, Application Administrator or Cloud Application Administrator can consent for the whole tenant:
https://login.microsoftonline.com/{your-tenant-id}/adminconsent?client_id=17f50414-705b-4b6e-ad04-f9d7a5db236fAlternatively, the first user to connect will see a "consent on behalf of your organization" checkbox if they hold one of those roles.
17f50414-705b-4b6e-ad04-f9d7a5db236f is the application ID. It's worth checking that it matches what your consent screen shows.
Revoking it
Whole tenant: Microsoft Entra admin center → Enterprise applications → Daslab → Delete. Every connection stops working immediately, for every user.
One user: disconnect the integration in Daslab, which purges the stored credential; or have the user revoke it at myapps.microsoft.com.
Revoking in Entra is the stronger of the two, because it works whether or not Daslab cooperates.
What's next
- Auth & permissions: the general model, and why the agent can never exceed your own access.
- Data: residency, retention, and no training on your data.
- Approvals: how the write gate works.
Updated 2026-08-07