Outlook integration

Last updated date:

How Seedling connects to Outlook, which read-only information it uses, and how access and deletion are controlled.

1. Overview

Outlook uses the Microsoft 365 connection, with Mail and Calendar selected separately.

You choose each mailbox by its exact Microsoft user ID. Seedling reads Microsoft's mailbox purpose, follows the active user only for a person-owned mailbox, and follows the primary calendar's Microsoft sharing permissions.

2. Connection and scope

Seedling verifies the provider account before storing the workspace connection. A current Seedling workspace administrator controls installation and disconnect; account identity is never inferred from an email address or display name.

Microsoft 365 connection
This Microsoft product uses the customer-managed, single-tenant Entra app configured for Microsoft 365. It does not need a separate credential.
Connection ownership
This connector is workspace-only. A current Seedling workspace administrator controls installation, credential replacement, disconnect, and purge for the exact connection.

3. Outlook data Seedling accesses

Seedling uses synchronized information for source-backed search, operating context, verification, and customer-approved workflows. Availability depends on the connected account, selected resources, provider plan, and native permissions.

Mail
Selected mailbox messages, bodies, conversation context, attachments context, and lifecycle state.
Calendars
Selected calendars and events, including organizers, attendees, timing, and sensitivity context.
Directory context
User and group identities needed to resolve the mailbox user and calendar sharing recipients.

4. Read-only permission contract

Mail.Read and Calendars.Read are app-only content roles. MailboxSettings.Read lets Seedling distinguish a person's mailbox from a shared, room, or equipment mailbox. Exchange Application RBAC or equivalent selected-resource controls must constrain the reachable mailbox population; no send or write role is requested.

  • User.Read.All — required directory identity. GroupMember.Read.All is additional and conditional on enabling directory.groups.
  • Mail.Read — read selected mailboxes without sending or modifying mail.
  • Calendars.Read — read selected calendars without mutating events.
  • MailboxSettings.Read — Microsoft grants application-level read access to mailbox settings tenant-wide. Seedling calls only userPurpose for each selected mailbox, uses it for owner access, and does not write mailbox settings.

5. Security and access

  • Provider credentials and other connection secrets are encrypted in the workspace tenant data plane, never returned to the browser, and excluded from logs and queue payloads.
  • Every source, synchronization, secret lookup, audience contribution, disconnect, and purge remains bound to the exact connection that created it.
  • Workspace connections use provider-returned object permissions and stable principals for human audience projection. Missing, stale, ambiguous, or unmappable ACL evidence contributes no human audience, and no Seedling administrator or steward may broaden it.
  • Mail is visible to the exact active Microsoft user only when Microsoft classifies the selected mailbox purpose as user. Sender, recipient, organizer, installer, administrator, and steward status do not grant access.
  • Primary-calendar events also follow Microsoft calendar sharing and delegation. Private events are limited to the mailbox user and delegates with private-event access.
  • A shared, room, equipment, other, or disabled mailbox has no inferred human mail owner. Because Microsoft Graph does not return Exchange Full Access mailbox delegates, shared-mailbox mail remains unavailable to members instead of guessing.
  • Generated output cannot bypass Seedling's human review, verification, and approval gates.

6. Retention and deletion

Connected data
Synchronized Outlook records remain while the connection is active and are removed through a durable integration purge after disconnect.
Credentials
Stored Outlook credentials or connection secrets and connection-owned synchronization state are deleted from active Seedling systems as part of the purge.
Backups
Deleted information may remain in encrypted, access-restricted backups until expiry, ordinarily within 35 days after active-system deletion.