1. Overview
One Microsoft 365 workspace connection supports Outlook, OneDrive, SharePoint, and Teams. Its customer-managed, single-tenant Entra app authenticates without a signed-in user.
The Microsoft tenant and application IDs identify the connection. You then select each mailbox, drive, SharePoint library, or team by its exact Microsoft ID rather than a domain or display name.
2. Connection and scope
Seedling verifies the provider account before storing the workspace connection. A current Seedling workspace administrator controls installation and disconnect; account identity is never inferred from an email address or display name.
- Admin-consented Entra application
- Your organization creates a dedicated Entra app and grants only the application permissions needed for the Microsoft products you select. Seedling verifies the app and each exact Microsoft source before synchronizing it.
- Workspace installation
- Microsoft 365 is connected to one Seedling workspace. Connecting the app does not by itself give workspace members access to Microsoft content; Seedling verifies each selected source separately.
3. Microsoft 365 data Seedling accesses
Seedling uses synchronized information for source-backed search, operating context, verification, and customer-approved workflows. Availability depends on the connected account, selected resources, provider plan, and native permissions.
- Outlook
- For an explicitly selected mailbox, authorized message bodies and previews, sender/from identity, conversation identity, and timestamps, plus bounded primary-calendar event details. Attachment bodies and non-primary calendars are outside V1.
- OneDrive and SharePoint
- For exact selected drives and libraries, Seedling reads folders, files, content, ownership, and available read-only permission information. Some advanced file coverage and permission mapping are not currently available.
- Microsoft Teams
- For an exact selected team, Seedling reads team and channel details plus supported channel messages. Complete replies and shared-channel handling are not currently available; private and group chats are unsupported.
- Directory context
- Read-only Microsoft directory information lets Seedling identify users consistently. Directory group access is optional and requires its own approved permission.
4. Read-only permission contract
The customer-managed connection uses only application read roles for the capabilities an administrator selects. It does not request delegated identity/offline-access scopes or mail, calendar, file, site, Teams, or chat write permissions.
- User.Read.All — required user identity context. GroupMember.Read.All is conditional on enabling directory.groups; hidden membership stays fail-closed without Member.Read.Hidden.
- MailboxSettings.Read identifies whether an Outlook mailbox belongs to one user or is shared, room, or equipment. Mail.Read and Calendars.Read read the selected content, granted either tenant-wide in Entra or through mailbox-scoped Exchange Application RBAC. Do not retain equivalent unscoped content roles when RBAC is intended to restrict mailboxes.
- Files.Read.All and Sites.Selected — selected OneDrive and SharePoint files and sites.
- Team.ReadBasic.All, Channel.ReadBasic.All, TeamMember.Read.All, ChannelMember.Read.All, and ChannelMessage.Read.All — selected Teams channels and messages.
5. Security and access
- Provider credentials and other connection secrets are encrypted in the workspace tenant data plane, never returned to the browser, and excluded from logs and queue payloads.
- Every source, synchronization, secret lookup, audience contribution, disconnect, and purge remains bound to the exact connection that created it.
- The provider does not expose enough object-level audience evidence for Seedling to reproduce every native permission safely. Workspace content therefore follows the connection's restricted-by-default policy; administrators and stewards receive no raw-content bypass.
- Tenant admin consent lets the application call Microsoft; it does not give every Seedling workspace member access to Microsoft content. If Microsoft access information is missing, stale, or ambiguous, Seedling does not show that content to a user.
- Generated output cannot bypass Seedling's human review, verification, and approval gates.
6. Retention and deletion
- Connected data
- Synchronized Microsoft 365 records remain while the connection is active and are removed through a durable integration purge after disconnect.
- Credentials
- Stored Microsoft 365 credentials or connection secrets and connection-owned synchronization state are deleted from active Seedling systems as part of the purge.
- Backups
- Deleted information may remain in encrypted, access-restricted backups until expiry, ordinarily within 35 days after active-system deletion.