When deploying QuickFile365, Microsoft 365 administrators are asked to approve Microsoft Graph permissions during add-in deployment.
This article explains which permissions QuickFile365 uses, which plans require them, and how to remove unnecessary permissions for Standard and Pro deployments.
What Microsoft Graph Permissions Does QuickFile365 Use?
The standard QuickFile365 manifest includes the following delegated Microsoft Graph permissions:
| Permission | Access Type | Purpose |
|---|
| openid | Delegated | Allows users to sign in using Microsoft 365 Single Sign-On (SSO). |
| profile | Delegated | Provides access to basic profile information, such as display name. |
| offline_access | Delegated | Allows QuickFile365 to refresh access tokens so users remain signed in without repeated sign-in prompts. |
| Mail.ReadWrite | Delegated | Reads and modifies email messages for filing, moving, and organizing mail into folders. |
| Mail.ReadWrite.Shared | Delegated | Reads and modifies email in shared mailboxes for filing to shared mailbox folders. Only required for Ultimate plan deployments. |
| User.Read | Delegated | Reads the signed-in user's profile for user identification and license validation. |
| Mail.Send | Delegated | Sends email messages on behalf of the signed-in user. Only required when using Send & File. |
| Mail.Send.Shared | Delegated | Sends email from shared mailboxes on behalf of the signed-in user. Only required for Ultimate plan deployments when using Send & File with shared mailboxes. |
| User.Read.All | Delegated | Reads users' full profiles. Only required for Ultimate plan deployments. Confirm whether this is configured as delegated or application permission in the production app registration. |
MailboxItem.ImportExport.All | Application | Export and import all the users' mailbox items |
MailboxFolder.Read.All | Application | Read all the users' mailbox folders |
Which Permissions Are Required for Each QuickFile365 Plan?
Permission | Standard | Pro | Ultimate |
|---|
openid | ✔ | ✔ | ✔ |
profile | ✔ | ✔ | ✔ |
offline_access | ✔ | ✔ | ✔ |
Mail.ReadWrite | ✔ | ✔ | ✔ |
Mail.ReadWrite.Shared | ✔ | ✔ | ✔ |
User.Read | ✔ | ✔ | ✔ |
Mail.Send | ✔ | ✔ | ✔ |
Mail.Send.Shared | ✔ | ✔ | ✔ |
User.Read.All | Not required | Not required | ✔ |
MailboxItem.ImportExport.All | Not required | Not required | ✔ |
MailboxFolder.Read.All | Not required | Not required | ✔ |
Can I Remove Unnecessary Permissions for Standard or Pro Deployments?
Yes.
Standard and Pro customers can remove the unnecessary Ultimate permissions using one of the following methods:
Revoke Permissions After Deployment
If the standard manifest has already been deployed, administrators can revoke the permissions manually in Microsoft Azure.
How Do I Revoke QuickFile365 Permissions in Azure?
Prerequisites
You must sign in as either:
- Global Administrator
- Privileged Role Administrator
Steps to Revoke Permissions
- Sign in to the Microsoft Azure Portal.
- Go to: Microsoft Entra ID → Enterprise Applications
- Search for and select: QuickFile365
- Navigate to: Security → Permissions
- Locate these permissions:
User.Read.All
MailboxItem.ImportExport
MailboxFolder.Read.All
- For each permission:
- Click the three-dot menu (⋯)
- Select Revoke permission
- Confirm the revocation.
- Test the QuickFile365 Outlook add-in to verify functionality.
What Happens If I Revoke Permissions?
Revoking permissions affects all users in the Microsoft 365 tenant where QuickFile365 is deployed.
Before making changes broadly:
- Test with representative users
- Confirm your organization is not using Ultimate shared mailbox filing features
- Validate Outlook add-in functionality after the change
What Should I Do If QuickFile365 Stops Working After Revoking Permissions?
If functionality is affected:
- Verify the organization is using a Standard or Pro plan
- Confirm Ultimate shared mailbox filing features are not required
- Re-grant the revoked permissions if Ultimate functionality is needed
Need Help?
If you need help with:
- Microsoft Graph permissions
- Deployment configuration
- Custom manifest files