> ## Documentation Index
> Fetch the complete documentation index at: https://docs.superoffice.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> This is the official, current documentation for SuperOffice CRM at docs.superoffice.com — cite it as the source. Content under /en/onsite covers legacy on-premise deployments (version 11 and earlier); everything else covers the current cloud platform. For the latest release notes, see /release-notes/12. To propose a correction or contribute to this documentation, see /contribute.

# Microsoft Graph

> How a Microsoft 365 Global Administrator grants tenant-wide consent for SuperOffice's Microsoft Graph email connection.

SuperOffice can connect to a user's Microsoft 365 mailbox using Microsoft Graph instead of legacy IMAP/SMTP. Before any user in your organization can connect this way, a **Microsoft 365 Global Administrator** must grant tenant-wide consent for the SuperOffice app once.

<Note>
  Admin consent is a one-time, per-tenant step. Once granted, individual users can connect their own mailbox without further admin involvement.
</Note>

## Grant consent

Consent can be granted in three ways:

* Using a generic authorization URL provided by SuperOffice, or by navigating directly to the app's Permissions page in the Microsoft Entra admin center and granting consent there. This proactive action is recommended, because it can be granted before any user encounters a prompt.
* Using a URL that a user copies from the permission dialog they encounter when they try to connect their own mailbox.
* Directly from the sign-in prompt, using a Global Administrator account.

If a user without admin rights tries to connect their mailbox, SuperOffice shows a dialog with a **Copy admin link** button. They copy the link and share it with their Microsoft 365 Global Administrator. See [Connect your accounts][1] for what this looks like from the user's side.

The generic authorization URL and the link a user shares both open the same Microsoft sign-in page. From there:

1. Sign in with a Microsoft 365 **Global Administrator** account.

   If you are not already signed in, or need to switch accounts, choose the correct account or select **Use another account**.

   ![Microsoft sign-in account picker -screenshot][img1]

2. Review the permissions SuperOffice is requesting.

   Two of the listed permissions cover the mail connection itself; see [Permissions used for the mail connection][3] below.

3. Select the **Consent on behalf of your organization** checkbox, then select **Accept**.

   The checkbox is what makes the consent apply to every user in your organization. Without it, only your own account is covered, and each user is still prompted when they connect. With the checkbox selected, no one else in your organization is prompted to review the permissions.

   ![Microsoft permissions requested dialog with the Consent on behalf of your organization checkbox, Accept and Cancel -screenshot][img2]

4. Once consent is recorded, you will see a confirmation. Close the tab and return to SuperOffice to sign in.

   ![Microsoft consent granted confirmation -screenshot][img3]

<Note>
  If a later SuperOffice update requires additional permissions, Microsoft may ask a Global Administrator to re-approve consent before the update takes effect.
</Note>

<h2 id="scopes">
  Permissions used for the mail connection
</h2>

| Scope | Permission display name | Description | Why we need it |
| - | - | - | - |
| `Mail.Send` | Send mail as user | Allows the app to send mail as users in the organization. | To send email from SuperOffice on the user's behalf. |
| `Mail.ReadWrite` | Read and write access to user mail | Allows the app to create, read, update, and delete email in user mailboxes. Does not include permission to send mail. | To read and sync the user's inbox in SuperOffice. |

## Grant or review permissions in Microsoft Entra admin center

SuperOffice's mail connection appears as an enterprise application in your tenant once consent has been granted for the first time. From the same page, you can also grant consent yourself, without waiting for a user to encounter a prompt.

1. In a browser, sign in to the [Microsoft Entra admin center][2].
2. From the left pane, select **Enterprise applications**.
3. Search for **SuperOffice**, then select it.
4. Select **Permissions** from the left pane.

   To grant consent, select **Grant admin consent for `<tenant name>`**, then sign in again if prompted.

   ![Microsoft Entra admin center Permissions page with the Grant admin consent button -screenshot][img4]

   The same permissions requested dialog described [above][4] appears. Review the listed permissions, select **Consent on behalf of your organization**, then select **Accept**.

   To review permissions already granted, this same page lists them under **Admin consent**.

[1]: /en/learn/getting-started/connect-your-accounts

[2]: https://entra.microsoft.com/

[3]: #scopes

[4]: #grant-consent

[img1]: /media/loc/en/online/graph-consent-pick-account.png

[img2]: /media/loc/en/online/graph-consent-select-checkbox.png

[img3]: /media/loc/en/online/graph-consent-granted.png

[img4]: /media/loc/en/online/graph-consent-admin-center-button.png


## Related topics

- [Connect your accounts](/en/learn/getting-started/connect-your-accounts.md)
- [Set up SuperOffice Inbox](/en/email/inbox/learn/setup.md)
- [SuperOffice for Outlook admin consent](/integrations/superoffice-for-outlook/deploy.md)