Scape connects to Outlook through Microsoft Graph. If your organization requires admin approval for mail access, approve Scape once. Each person then connects their own mailbox; approval alone gives Scape no mailbox access.
Select Approve Scape for your organization. Sign in as a Cloud Application Administrator, Application Administrator, Privileged Role Administrator or Global Administrator.
2. Check the app and permissions
Microsoft shows Permissions requested and Accept for your organization. Check the app name, publisher and client ID:
Scape, published by Scape AB with Microsoft's blue verified badge (Partner ID 7182421).
Scape requests delegated permissions only, so it can reach only what the connected person can already access, such as shared mailboxes and calendars. It requests no application permissions and cannot change tenant settings, users or other apps. Expand a permission to read Microsoft's description.
Permissions
Permission
What Scape uses it for
openid Sign users in
Sign in with a Microsoft account.
email View users' email address
Read the primary email address.
profile View users' basic profile
Read basic profile details, including the name.
offline_access Maintain access to data you have given it access to
Keep the mailbox in sync without repeated sign-in.
User.Read Sign in and read user profile
Identify the mailbox address and user principal name.
Mail.ReadWrite Read and write access to user mail
Sync messages, attachments and folders; organize mail and create drafts. Does not send mail.
Mail.Send Send mail as a user
Send messages from the connected mailbox.
Mail.ReadWrite.Shared Read and write user and shared mail
Sync shared mailboxes the person has access to.
Mail.Send.Shared Send mail on behalf of others
Send from shared mailboxes the person has permission to send from.
MailboxSettings.ReadWrite Read and write user mailbox settings
Read and update Outlook categories to match Scape labels.
Calendars.ReadWrite Have full access to user calendars
Show, create and edit events, and add Teams meetings.
Calendars.ReadWrite.Shared Read and write user and shared calendars
Show calendars others share with the person.
Contacts.ReadWrite Have full access to user contacts
Show contact names and suggest recipients. Scape reads contacts and doesn't change them.
People.Read Read users' relevant people lists
Suggest people the person emails often.
User.ReadBasic.All Read all users' basic profiles
Find colleagues by name.
3. Accept, then tell people to reconnect
Select Accept, then close the page that opens. People can now open Scape and connect Outlook again. To restrict who can connect, follow Limit access below.
People waiting for approval see this screen in Scape.
Under Enterprise apps > Consent and permissions > User consent settings, Microsoft's recommended default, Let Microsoft manage your consent settings, excludes Mail.ReadWrite, Mail.ReadWrite.Shared, MailboxSettings.ReadWrite, Calendars.ReadWrite, Calendars.ReadWrite.Shared, Contacts.ReadWrite and People.Read from user consent. If user consent is disabled, every app needs admin approval. You don't need to change this setting to approve Scape.
As a Global Administrator, open Enterprise apps > Consent and permissions > Admin consent settings.
Set Users can request admin consent to apps they are unable to consent to to Yes. Choose reviewers under Who can review admin consent requests and select Save. Reviewers need an approval role listed in step 1.
This can take up to an hour. People then see Approval required, enter a reason and select Request approval. Reviewers receive an email. In Enterprise apps > Activity > Admin consent requests > My Pending, select Scape, then Review permissions and consent and Accept. See Microsoft's workflow setup.
Limit access
After approval, open Scape under Enterprise apps > All applications:
Under Manage > Properties, set Assignment required? to Yes and select Save.
Open Users and groups > Add user/group. Under Users and groups, choose None Selected, choose people or groups, then Select and Assign.
Only assigned people can connect, except Global Administrators. Group assignment requires Entra ID P1 or P2; nested groups aren't included. See Microsoft's assignment instructions.
Revoke access
Open Scape under Enterprise apps > All applications:
To revoke permissions, open Permissions > Admin consent, then ... > Revoke permission. Grants under User consent require PowerShell or Microsoft Graph.
To block new tokens, open Properties, set Enabled for users to sign-in? to No, then Save.
To remove Scape, select Properties > Delete, then Yes. Microsoft allows restoration for 30 days.
Revoking access doesn't delete data Scape already holds. People can delete their account under Settings > Account > Delete account in Scape, or email dpo@scape.app. See the Privacy Policy.
