Microsoft 365: security & access scoping

No account gets "connected" and no password is ever stored. An administrator in your organization approves our application once (a Microsoft Entra org-level consent). From then on, Sonocall obtains application tokens on demand, directly from Microsoft — the official Microsoft Graph app-only model.

The result: no expiring sessions, no shared credentials, and revocation at any time from your Entra portal (Enterprise applications) or in one click inside Sonocall.

• Calendars.ReadWrite — check availability and create meetings (Teams link included)
• Presence.Read.All — know whether an employee is available in Teams before transferring
• User.Read.All — resolve "Martin" or "finance" against your real directory
• Mail.Send — send confirmations from your real mailbox (e.g. reception@)
• Sites.Read.All + Files.Read.All — read the SharePoint documents you choose to sync (read-only)

By default, a Microsoft application permission is org-wide. Microsoft ships exactly the tool to restrict it: Exchange Application Access Policies. One PowerShell command limits our application to a mailbox group you choose (reception, the sales team — nothing else):

~10 minutes, under your control, auditable, reversible. On top of that, Sonocall ships its own in-product scope setting: the assistant can be restricted to a precise list of employees for calendar operations — no PowerShell required.

• No Microsoft passwords stored — ever
• No data used to train AI models
• No action outside the capabilities you enable (every capability has its own switch)
• No writes to SharePoint — the sync is read-only
• One-click disconnect: Teams references are deactivated and tokens invalidated

If you manage your clients' M365 under delegated admin rights (GDAP), you can perform the org consent on the client's behalf — the end client installs nothing: no software, no extra licenses, no change to their phone system.

Calls and caller data are processed and stored on our Canadian infrastructure (Montréal). Microsoft Graph requests go directly to your organization's Microsoft cloud — we keep only what's operationally needed (e.g. the confirmation of a created meeting), per our privacy policy and DPA.