Who Can Do This
✅ Client IT Admin: this article is a reference for admins and security reviewers evaluating the add-in before granting admin consent. No action is required.
Overview
The consent screen shows large Microsoft permission groups because of how Microsoft packages them, not because of how Trunk Tools uses them. Every action is started by a user, only reaches what that user can already see, and nothing is sent or scheduled without the user’s approval.
Every action is started and controlled by a user
The add-in does nothing in the background and nothing on its own. It acts only when a user asks in the Outlook side panel, and it acts as that user, never as an admin or service account.
It never sends email. When a user asks for a draft, it saves the draft to their Drafts folder. The user reviews it, edits it if needed, and clicks Send themselves. The add-in does not have permission to send mail.
It never schedules or changes a meeting without approval. It proposes the meeting, and nothing goes on the calendar until the user approves. Once they approve, Outlook sends the invitations as usual.
It only opens files the user points it to, such as a OneDrive or SharePoint link in an email they ask about.
Access is limited to what each user can already see
All permissions are delegated. The add-in can reach only what the signed-in user can already reach in Outlook, OneDrive, or SharePoint. It has no tenant-wide access and cannot see any other user’s mailbox or files.
Trunk Tools does not store users’ Microsoft credentials. The add-in uses a short-lived sign-in token from the user’s Outlook session only while it answers that user’s request. Trunk Tools servers do not save or log the token.
What each permission is for
Read and write access to user mail: lets the assistant save draft emails and reply drafts to the user’s Drafts folder when they ask. Microsoft offers draft creation only under the read/write permission. Sending is always done by the user.
Have full access to user calendars: lets the assistant answer questions like “when am I free Thursday?” and propose meetings. Microsoft requires this permission for any app that creates meetings. Meetings are added only after the user approves the proposal.
Read user and shared calendars: lets the assistant see calendars coworkers have already shared with the user, for example to find a time that works for everyone. It sees only what the user can already see in Outlook.
Read users’ relevant people lists: lets the assistant work out who someone like “Mike from the GC” is when filling in email recipients or meeting invitees.
Read all files that user can access: lets the add-in open a OneDrive or SharePoint file when a user asks about a link in an email. The add-in can’t know in advance where a shared link points, so this broader permission is required. It opens only files the user already has access to, and only when the user asks. Your organization’s consent settings route this permission to an admin for approval, which is why it appears on the review screen.
Maintain access to data you have given it access to and View users’ basic profile: Microsoft’s sign-in system adds these to every app automatically, and Trunk Tools does not request them directly. They identify the user and keep them signed in between sessions.
If you have any additional questions please contact your Trunk Tools Technical Account Manager or reach out to support@trunk.tools.