When deploying QuickFile365, Microsoft 365 administrators are asked to approve Microsoft Graph permissions during add-in deployment.
This article explains which permissions QuickFile365 uses, which plans require them, and how to remove unnecessary permissions for Standard and Pro deployments.
What Microsoft Graph Permissions Does QuickFile365 Use?
The standard QuickFile365 manifest includes the following delegated Microsoft Graph permissions:
Permission | Purpose |
openid | Allows users to sign in using Microsoft 365 Single Sign-On (SSO). |
profile | Provides access to basic profile information such as display name. |
offline_access | Allows QuickFile365 to refresh access tokens so users remain signed in and background filing operations continue without repeated sign-in prompts. |
Mail.ReadWrite | Reads and modifies email messages for filing, moving, and organizing mail into folders. |
Mail.ReadWrite.Shared | Reads and modifies email in shared mailboxes for filing to shared mailbox folders. Only required for Ultimate plan deployments. |
User.Read | Reads the signed-in user profile for user identification and license validation. |
Mail.Send | Sends email messages on behalf of the signed-in user. Only required when using the Send and File feature. |
Mail.Send.Shared | Sends email from shared mailboxes on behalf of the signed-in user. Only required for Ultimate plan deployments when using the Send and File feature with shared mailboxes. |
Which Permissions Are Required for Each QuickFile365 Plan?
Permission | Standard | Pro | Ultimate |
openid | ✔ | ✔ | ✔ |
profile | ✔ | ✔ | ✔ |
offline_access | ✔ | ✔ | ✔ |
Mail.ReadWrite | ✔ | ✔ | ✔ |
Mail.ReadWrite.Shared | Not required | Not required | ✔ |
User.Read | ✔ | ✔ | ✔ |
Mail.Send | Only for Send and File | Only for Send and File | Only for Send and File |
Mail.Send.Shared | Not required | Not required | Only for Send and File with shared mailboxes |
Why Don't Standard and Pro Plans Require Mail.ReadWrite.Shared or Mail.Send.Shared?
Standard and Pro plans file email only to the signed-in user's own mailbox.
Because no shared mailbox filing or shared mailbox sending is performed, these plans do not require:
- Mail.ReadWrite.Shared
- Mail.Send.Shared
These permissions are only required for Ultimate plan features that support filing to shared mailboxes and sending from shared mailboxes.
Why Is Mail.Send Only Required When Using Send and File?
Mail.Send is used exclusively by the Send and File feature, which sends an email and then files it in one action.
If your organization does not use Send and File, Mail.Send is not required.
Similarly, Mail.Send.Shared is only required for Ultimate plan deployments that use Send and File with shared mailboxes.
Can I Remove Unnecessary Permissions for Standard or Pro Deployments?
Yes.
Standard and Pro customers can remove the unnecessary Ultimate permissions using one of the following methods:
Option 1 — Request a Custom Manifest
Before deployment, request a customized QuickFile365 manifest file from Standss Support with the following permissions removed:
- Mail.ReadWrite.Shared
- Mail.Send.Shared
If Send and File is not used, you can also request removal of:
This is the recommended approach for new deployments.
Option 2 — Revoke Permissions After Deployment
If the standard manifest has already been deployed, administrators can revoke the permissions manually in Microsoft Azure.
How Do I Revoke QuickFile365 Permissions in Azure?
Prerequisites
You must sign in as either:
- Global Administrator
- Privileged Role Administrator
Steps to Revoke Permissions
- Sign in to the Microsoft Azure Portal.
- Go to: Microsoft Entra ID → Enterprise Applications
- Search for and select: QuickFile365
- Navigate to: Security → Permissions
- Locate these permissions:
- Mail.ReadWrite.Shared
- Mail.Send.Shared
- Mail.Send (only if Send and File is not used)
- For each permission:
- Click the three-dot menu (⋯)
- Select Revoke permission
- Confirm the revocation.
- Test the QuickFile365 Outlook add-in to verify functionality.
What Happens If I Revoke Permissions?
Revoking permissions affects all users in the Microsoft 365 tenant where QuickFile365 is deployed.
Before making changes broadly:
- Test with representative users
- Confirm your organization is not using Ultimate shared mailbox filing features
- Confirm your organization is not using Send and File
- Validate Outlook add-in functionality after the change
What Should I Do If QuickFile365 Stops Working After Revoking Permissions?
If functionality is affected:
- Verify the organization is using a Standard or Pro plan
- Confirm Ultimate shared mailbox filing features are not required
- Confirm Send and File is not required
- Re-grant the revoked permissions if Ultimate functionality or Send and File is needed
Need Help?
If you need help with:
- Microsoft Graph permissions
- Deployment configuration
- Custom manifest files