Overview
Deployment has two required parts: deploy the add-in, then grant admin consent so Trunk Tools can access Microsoft 365 on your users’ behalf. Nothing to download or host. Updates are delivered automatically.
Trunk Tools’ servers connect to Microsoft 365 through Microsoft Graph to read emails and attachments for users. If your organization restricts sign-ins by location with Conditional Access, you also need to allow those servers. See Allow Trunk Tools servers in Conditional Access.
Who Can Do This
✅ Client IT Admin: needs the Microsoft 365 admin roles listed below.
Deploy the add-in: Global Administrator or Exchange Administrator
Grant admin consent: Global Administrator, Privileged Role Administrator, or Cloud Application Administrator
Edit Conditional Access (if needed): Conditional Access Administrator, Security Administrator, or Global Administrator
If the person deploying the add-in doesn’t hold a consent role, have someone who does complete Step 2: Grant admin consent.
Requirements
Mailboxes hosted in Exchange Online. On-premises Exchange Server is not supported.
Outlook on the web, the new Outlook for Windows, or classic Outlook for Windows with a Microsoft 365 subscription.
A Trunk Tools account for each user, matching their Microsoft 365 sign-in address (user principal name).
If the sign-in address differs from the email address users send from (for example,
jdoe@contoso.onmicrosoft.comvs.jane@contoso.com), the account must use the sign-in address.Coordinate provisioning with your Trunk Tools contact before a broad rollout.
Government and sovereign cloud tenants (such as GCC High) are not currently supported. Contact your Trunk Tools representative.
Step 1: Deploy the add-in from Microsoft Marketplace
Sign in to the Microsoft 365 admin center as an administrator. (The admin center is also available at admin.cloud.microsoft.)
In the left navigation go to Show all → Settings → Integrated apps.
Select Get apps, search for Trunk Tools, and select Trunk Tools for Construction.
Select Get it now and accept the terms if prompted.
Choose who receives the add-in:
Just you: recommended for a quick test
Specific users or groups: users added to a group later receive the add-in automatically
Entire organization
On Accept permission requests, review the permissions and select Accept permissions.
On the review page, confirm the details and select Finish deployment.
A green checkmark appears next to Trunk Tools for Construction under Integrated apps once deployment is complete. Deployment can take up to 24 hours to reach all users, though it is usually much faster. Users may need to restart Outlook or reload Outlook on the web.
If you deployed to just yourself, select the app under Integrated apps and choose Edit users to expand access when you’re ready.
Step 2: Grant admin consent (required)
Accepting permissions in Step 1 approves the add-in’s access to the user’s mailbox in Outlook. Trunk Tools also needs Microsoft Graph permissions to read emails, attachments, calendars and files on your users’ behalf. These require admin consent. Without it, users will see a Microsoft “Need admin approval” prompt when they open Trunk Tools.
While signed in with a role that can grant consent, open the admin consent link: https://login.microsoftonline.com/organizations/adminconsent?client_id=6bdef7b6-9fb0-4d4c-8292-1fb4c3616485&redirect_uri=https%3A%2F%2Foutlook.trunktext.com
On Permissions requested: Review for your organization, confirm the app is Trunk Tools for Construction (verified publisher Trunk Tools Inc.).
Review the permissions and select Accept.
Once consent is granted, users sign in normally.
Checking consent later
In the Microsoft Entra admin center, go to Entra ID → Enterprise applications and search by Application ID
6bdef7b6-9fb0-4d4c-8292-1fb4c3616485(the most reliable method).Under Security → Permissions, review granted permissions, or select Grant admin consent for [your organization] again if needed.
Want to know what each permission is for? See Outlook Add-in: Permissions & Data Access.
Allow Trunk Tools servers in Conditional Access
Who needs this: organizations with a Conditional Access policy that blocks or restricts access based on location (for example, “only allow access from our office IPs”).
Why: some Trunk Tools features, such as drafting a reply that uses email attachments, are processed on Trunk Tools’ servers, which call Microsoft Graph on the user’s behalf. Those calls come from Trunk Tools’ IP addresses, not the user’s device, so a location-based policy will block them. Users can still sign in, but these features show a warning in the Trunk Tools pane.
Trunk Tools server IP addresses
Trunk Tools is moving its servers to new infrastructure. Add all six addresses below so Trunk Tools keeps working during and after the move.
All steps are in the Microsoft Entra admin center.
Create a named location
Go to Protection → Conditional Access → Named locations and select + IP ranges location.
Name it Trunk Tools servers and add all six IP addresses.
Allow the named location in the policy that blocks access
Find the Conditional Access policy (or policies) that:
is set to On (not Report-only),
has a Conditions → Locations condition, and
targets Microsoft Graph, Office 365, Office 365 Exchange Online, or All resources.
Then apply whichever fix matches how the policy is written:
Policy is set to Include: Any location / Exclude: All trusted locations: open the Trunk Tools servers named location and select Mark as trusted location.
Marking a location as trusted also lowers sign-in risk scoring for those IPs and satisfies other policies based on trusted locations (such as MFA registration rules).
Any other policy: add Trunk Tools servers to the policy’s Locations → Exclude list. You don’t need to mark it as trusted.
Check for requirements an IP address can’t meet
If the same policy also requires a compliant device, hybrid-joined device, approved client app, or token protection, allowing the IP addresses won’t be enough, because Trunk Tools’ servers are not enrolled devices. In that case, contact Trunk Tools support to discuss an exception scoped to the Trunk Tools app or to the affected users.
You don’t need to exclude any client apps, and this does not affect admin consent. Consent is a separate step that has already succeeded if users can sign in.
Test
Changes usually take effect within a few minutes. Allow up to an hour.
Have a Trunk user run an action that reads email or attachments, such as drafting a reply with attachments selected. The warning should no longer appear.
If it still appears, note the approximate time of the attempt and contact Trunk Tools support so we can match it against our logs.
What your users will see
A Trunk Tools for Construction button appears in the Outlook ribbon when reading or composing an email.
Selecting it opens the task pane, which users can pin to keep open between emails.
Sign-in uses the user’s Microsoft identity, so there is no separate password to manage.
Updates
Updates are delivered automatically through Microsoft Marketplace and appear the next time users open Outlook. You don’t need to upload anything.
If an update requests new permissions, Trunk Tools for Construction shows a pending update under Settings → Integrated apps. Users stay on the current version until an administrator reviews and accepts the new permissions.
Remove the add-in
Under Settings → Integrated apps, select Trunk Tools for Construction and remove it or change which users have access.
To also revoke Graph access, delete the Trunk Tools for Construction app under Entra ID → Enterprise applications.
If you created a Conditional Access named location, you can delete it.
FAQs
I'm having trouble, who can help me?
Contact your Trunk Tools Technical Account Manager, or reach out to Support@trunk.tools, for user account provisioning, Conditional Access exceptions, or any deployment questions.
Users see “Need admin approval” when they open Trunk Tools.
Admin consent hasn’t been granted. Complete Grant admin consent above.
What do these permissions do?
Users can sign in, but a feature shows a warning in the Trunk Tools pane.
A location-based Conditional Access policy is the most likely cause. See Allow Trunk Tools servers in Conditional Access.
The add-in doesn’t appear in Outlook.
Deployment can take up to 24 hours. Have the user restart Outlook or reload Outlook on the web, and confirm they’re in the user or group the add-in was assigned to.
Can we deploy to a few users first?
Yes. Assign it to just yourself or to specific users or groups, then expand access under Edit users.