Can the agent read every mailbox in our tenant?

Not after setup. Graph application permissions are tenant-wide by default; an Exchange application access policy limits the app to the mailboxes in a named group before any agent runs. The policy is yours to inspect and change.

Do our staff need new logins?

No. The system signs people in with Entra ID; roles follow your groups. A departure in Entra removes access to the system the same moment.

Does the agent send from Outlook?

Only after a person approves, and only if Mail.Send has been granted. Most builds start read-only and add sending after the first month.

What about OneDrive or SharePoint?

With Files.ReadWrite.All, the system can mirror every settled document into its paper folder. The system’s own storage stays the record; the mirror is for the people who live in OneDrive.

Microsoft 365, scoped to the mailboxes you name.

Graph can read every mailbox in a tenant by default. KYN narrows it with an Exchange application access policy to the mailboxes you name before any agent reads a line. Staff sign in to the system with Entra ID.

Get a quote →All integrations

The agent reads
- Mail and attachments in the mailboxes named in the access policy
- Calendar free/busy for scheduling, where granted
- Directory names for sign-on
The agent writes
- Draft replies in the thread for a person to send
- Categories and folder moves after classification
- Documents to a named OneDrive or SharePoint folder, mirrored from the system
A person approves
- Sending any message
- Reading a mailbox outside the access policy
- Widening the policy

Setting it up.

Access	An Entra app registration in your tenant with Mail.Read and, for outbound, Mail.Send as application permissions; an Exchange application access policy restricting it to a named group of mailboxes; admin consent recorded.
Sign-on	Entra ID as the identity provider for the system; roles mapped from your groups.
Secrets	Client secret in the cloud secret store; expiry tracked and rotated before it lapses.
Time	About 3 working days, plus your admin’s consent step.

Builds that use it.

Purchasing chain: request to receiving →Will and estate-planning document platform →Build library →

Questions buyers ask

Can the agent read every mailbox in our tenant?: Not after setup. Graph application permissions are tenant-wide by default; an Exchange application access policy limits the app to the mailboxes in a named group before any agent runs. The policy is yours to inspect and change.
Do our staff need new logins?: No. The system signs people in with Entra ID; roles follow your groups. A departure in Entra removes access to the system the same moment.
Does the agent send from Outlook?: Only after a person approves, and only if Mail.Send has been granted. Most builds start read-only and add sending after the first month.
What about OneDrive or SharePoint?: With Files.ReadWrite.All, the system can mirror every settled document into its paper folder. The system’s own storage stays the record; the mirror is for the people who live in OneDrive.