Admin consent for Microsoft 365

Microsoft lets each organization decide which apps its people may allow to read their data. Many organizations, and Microsoft’s own default settings for the broader permissions, require an admin to approve an app first. AutomaDoc asks for as little as it can, and only when you need it.

For IT admins: approve in one click

If you administer your organization’s Microsoft 365, approve AutomaDoc once and everyone in the organization can use it:

Approve for my organization

This covers signing in, Excel workbooks and SharePoint lists. If your organization uses Dataverse (Power Apps), approve it as well. It is a separate step because Microsoft refuses it in organizations without Dataverse:

Approve Dataverse access

Microsoft signs you in, lists the permissions and asks you to accept them for your organization. You need one of these Microsoft Entra roles: Global Administrator, Privileged Role Administrator, Cloud Application Administrator or Application Administrator. Microsoft’s screen may show the publisher, KSI Digital, as unverified; the permissions it lists are the ones in the table below, and nothing else.

People in your organization can also send you the Company Portal’s IT admin page, which has the same buttons: https://company.automadoc.cc/#/microsoft-admin

What AutomaDoc asks for

Permission	Asked when	Why	Admin approval usually needed?
openid (OpenID Connect)	Signing in	Signs the person in with their Microsoft account	Only if your organization blocks all user consent
profile (OpenID Connect)	Signing in	Shows the person’s name in AutomaDoc	Same
email (OpenID Connect)	Signing in	Reads the person’s email address, which identifies them in your AutomaDoc account	Same
offline_access (OpenID Connect)	Signing in	Keeps the person signed in, and lets their automations run while they are away	Same
access_as_user (AutomaDoc)	Opening the Excel or Word add-in	Lets the add-ins sign in to AutomaDoc with the person’s Office account, without a second sign-in	Same
Files.ReadWrite.All (Microsoft Graph)	Connecting Excel workbooks	Reads the rows of the workbooks the person uses, and saves documents next to them	Yes, by default
Sites.ReadWrite.All (Microsoft Graph)	Connecting SharePoint lists	Reads list items, writes status and link columns, and attaches documents	Yes, by default
user_impersonation (Dynamics CRM)	Connecting Dataverse (Power Apps)	Reads Dataverse tables as the person, under their own security roles	Depends on your organization

AutomaDoc only ever acts as the person signed in: it can read and write what their own account can, never more. Generating from the rows you select in the Excel add-in needs none of the data permissions: the add-in sends AutomaDoc only those rows.

Your data

AutomaDoc reads only the workbooks, lists and tables a person picks for their templates. The documents it makes are kept for your plan’s retention period, and Microsoft tokens are stored encrypted and erased when the person disconnects. See the Privacy Policy.

When your organization asks for an admin

If Microsoft says an admin must approve, AutomaDoc shows Your organization needs an IT admin to approve AutomaDoc, at sign-in or on the Integrations page of the Company Portal, with a Link for your IT admin:

1. Click Copy link and send it to your IT admin (or click I am the admin if that is you).
2. The link opens AutomaDoc’s IT admin page: what AutomaDoc asks for, and the approval for the whole organization in one click.
3. Once your admin has approved, sign in or connect again. This time Microsoft lets you through.

The link names your organization when Microsoft told AutomaDoc which one it is, so the approval lands in the right place. It contains nothing secret.

In the Excel or Word add-in, the pane says so and offers Open the approval link to send to your admin, which opens the same IT admin page in your browser.

Managing AutomaDoc in Microsoft Entra

• The app is listed in your tenant as AutomaDoc under Enterprise applications after the first sign-in or approval.
• To make someone an AutomaDoc admin without a directory role, assign them the AutomaDoc.Admin app role in Enterprise applications → AutomaDoc → Users and groups. It takes effect within 10 minutes (immediately for purchases and API keys).
• To remove AutomaDoc entirely, delete it from Enterprise applications. A person can remove their own grant in My Apps (myapps.microsoft.com); Disconnect on the Integrations page makes AutomaDoc forget its copy.
• To install the Excel and Word add-ins for everyone, see Deploy the add-ins for your organization.