To let your users connect their Outlook mailbox to Speya, your Microsoft Entra ID (Azure AD) administrator approves Speya's enterprise application for delegated Microsoft Graph permissions. It is a one-time task of about 15 minutes, and no Exchange, DNS or firewall changes are needed.
You choose one of two access levels for your organisation:
Access level | Permission to approve | What your users get |
Send only (minimum) | Mail.Send | Users send supplier emails from their own Outlook address. Replies go to a Speya reply-to address and are shown on the platform. Speya cannot read the mailbox. |
Send and capture replies (optional) | Mail.Send + Mail.Read | Replies land in the user's own Outlook inbox as normal. Speya picks out only replies to emails sent through Speya and shows them on the platform; everything else is discarded unread. |
In both cases Speya acts only as the signed-in user, on that user's own mailbox. Speya never uses tenant-wide (application) permissions and cannot reach any other mailbox, calendar, file or Teams data.
This guide is written for the IT team that approves the connection. If you are a Speya user who wants to send emails from your own mailbox, see How to email suppliers with RFx.
In this article
Who in your organisation should handle this
What Speya requests
Step 1: Check your tenant's consent settings
Option A: Allow Mail.Send only
Option B: Allow Mail.Send and Mail.Read
Optional controls
How Speya handles your data
Connecting a mailbox in Speya (for end users)
Contact
Who in your organisation should handle this
Send this guide to the team that administers Microsoft Entra ID (often called the identity, IAM or Microsoft 365 admin team). They are the only team that has to act; the others below may want to review or be informed, depending on your internal process.
Team | Role in this request | Microsoft role needed |
Identity / Entra ID administrators | Approve Speya's app and grant consent (required) | Cloud Application Administrator or Application Administrator. Changing tenant-wide user consent settings requires Privileged Role Administrator or Global Administrator. |
Information security / CISO | Vendor risk review; optional Conditional Access and monitoring | Security Administrator (for Conditional Access) |
Data protection officer / Legal | Review data handling against the Speya privacy policy and DPA | None |
Messaging / Exchange team | Inform only. No Exchange configuration is required for delegated access. | None |
Procurement / vendor management | Vendor onboarding, if your process requires it | None |
If your organisation has no separate teams, your Microsoft 365 Global Administrator can do everything in this guide.
Text you can paste into an internal IT ticket
Request: Approve the Microsoft Entra enterprise application "Speya Mail (Prod)" (publisher: Speya Intelligence AB) for delegated Microsoft Graph permissions so that <team/users> can send supplier emails from their own Outlook mailbox via the Speya platform.
Permissions: Mail.Send (required) and, optionally, Mail.Read for reply capture, plus standard sign-in scopes (openid, profile, email, offline_access, User.Read). Delegated only; no application permissions.
Scope: Limit to the security group <group name> if required.
Reference: Speya IT administrator guide (https://intercom.help/speya/en/) and privacy policy, section 2.4: https://speya.ai/legal/privacy-policy
What Speya requests
All permissions are delegated Microsoft Graph permissions: Speya acts as the signed-in user, only on that user's own mailbox, and only while the user's consent is in place.
Permission | Type | Required for | What it allows |
openid, profile, email | Delegated | Both levels | Sign the user in and read their name and email address (used as the sender). |
offline_access | Delegated | Both levels | Keep the connection active without the user signing in each time (refresh token). |
User.Read | Delegated | Both levels | Read the signed-in user's basic profile. |
Mail.Send | Delegated | Both levels | Send email as the signed-in user from their own mailbox. Does not allow sending as other users or from shared mailboxes. |
Mail.Read | Delegated | Send and capture replies only | Read messages in the signed-in user's mailbox. Speya uses it only to detect replies to emails sent through Speya; see "How Speya handles your data". |
Speya does not request and will never use: application (tenant-wide) permissions, Mail.ReadWrite, Mail.Send.Shared, MailboxSettings, calendar, contacts, OneDrive/SharePoint or Teams permissions. Speya does not modify, delete, flag or move messages, and does not create forwarding or inbox rules.
Two Speya apps in your tenant. If your users also sign in to Speya with their Microsoft account, you will see a second Speya enterprise application used only for sign-in. It requests no mail permissions. This guide concerns the mail connection app only; check the client ID below before granting consent.
Application details
Field | Value |
Application name in Entra | Speya Mail (Prod) |
Application (client) ID | 46f05550-5a6d-4af1-ba5c-4c6ec951566a |
Publisher | Speya Intelligence AB, Microsoft verified publisher (MPN ID 7150505) |
Verify before consenting | The app's client ID and publisher shown in the Microsoft consent prompt must match this table. If they do not, do not grant consent and contact us. |
Redirect URIs |
Step 1: Check your tenant's consent settings
Your user consent setting decides whether users can connect on their own or need an administrator first. Most organisations that restrict third-party apps need the admin steps in Option A or B below.
Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.
Go to Entra ID › Enterprise apps › Consent and permissions › User consent settings.
Read the value under User consent for applications and use the table below.
Current setting | What happens when a user connects Speya | What you need to do |
Do not allow user consent | User sees "Need admin approval" and cannot connect. | Grant admin consent (Option A or B). |
Allow user consent for apps from verified publishers, for selected permissions / Let Microsoft manage your consent settings | Depends on which permissions your policy classifies as user-consentable. Mail permissions often require admin approval. | Grant admin consent (Option A or B) for a consistent result. |
Allow user consent for apps (legacy) | Each user can approve Speya for their own mailbox, including Mail.Read. | Nothing is required, but we recommend Option A or B so IT controls which access level is allowed. |
Recommended: turn on the admin consent workflow under Consent and permissions › Admin consent settings. Users who are blocked can then send a request to named reviewers in-product instead of raising a separate ticket.
Microsoft references: Configure user consent · Manage app consent policies
Option A: Allow Mail.Send only
Grant tenant-wide consent for Mail.Send and the sign-in scopes, and nothing else. Users can then send from their own address; replies go to Speya's reply-to address, so Speya never reads your mailboxes.
The Grant admin consent button in the Entra portal approves every permission on Speya's app registration, which includes Mail.Read. To approve send-only, use one of the two scoped methods below instead.
Method 1: Scoped admin consent link (no scripting)
Open this link signed in as a Cloud Application Administrator (or higher), review the listed permissions and select Accept. Replace {tenant-id} with your tenant ID or primary domain.
https://login.microsoftonline.com/{tenant-id}/v2.0/adminconsent
?client_id=46f05550-5a6d-4af1-ba5c-4c6ec951566a
&scope=openid profile email offline_access https://graph.microsoft.com/User.Read https://graph.microsoft.com/Mail.Send
&redirect_uri=https://speya.ai.auth0.com/login/callback(Line breaks added for readability; enter the URL on one line, with spaces between scopes.)
Method 2: Microsoft Graph PowerShell
Connect-MgGraph -Scopes "Application.ReadWrite.All","DelegatedPermissionGrant.ReadWrite.All"
# Speya's enterprise app (create it in your tenant if it does not exist yet)
$speya = Get-MgServicePrincipal -Filter "appId eq '46f05550-5a6d-4af1-ba5c-4c6ec951566a'"
if (-not $speya) { $speya = New-MgServicePrincipal -AppId '46f05550-5a6d-4af1-ba5c-4c6ec951566a' }
# Microsoft Graph
$graph = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
New-MgOauth2PermissionGrant -BodyParameter @{
clientId = $speya.Id
consentType = "AllPrincipals"
resourceId = $graph.Id
scope = "openid profile email offline_access User.Read Mail.Send"
}
Keep it send-only. If your user consent setting is Allow user consent for apps, a user could still approve Mail.Read for themselves. To prevent that, set user consent to Do not allow user consent (or a policy that excludes mail permissions) and route requests through the admin consent workflow. In Speya, users then pick Send only under Settings › Email.
Verify: Entra ID › Enterprise apps › Speya Mail (Prod) › Security › Permissions › Admin consent tab should list only the scopes above.
Microsoft reference: Grant tenant-wide admin consent
Option B: Allow Mail.Send and Mail.Read
Grant both mail permissions so users can choose Send and capture replies. Replies stay in each user's own inbox, and Speya shows copies of the relevant replies on the platform.
Mail.Read is technically read access to the signed-in user's mailbox. Speya's use of it is limited by its privacy policy and processing design: only new inbox messages are checked, only replies to Speya-sent emails are kept, and all other messages are discarded in memory without being stored, logged or read by a person.
Use any one of these methods:
Method 1: Entra admin center
Entra ID › Enterprise apps › All applications › Speya Mail (Prod) › Security › Permissions › Grant admin consent for <your organisation>. If Speya is not listed yet, use the link in Method 2; the app appears after the first consent.
Method 2: Admin consent link
https://login.microsoftonline.com/{tenant-id}/v2.0/adminconsent
?client_id=46f05550-5a6d-4af1-ba5c-4c6ec951566a
&scope=openid profile email offline_access https://graph.microsoft.com/User.Read https://graph.microsoft.com/Mail.Send https://graph.microsoft.com/Mail.Read
&redirect_uri=https://speya.ai.auth0.com/login/callback(Line breaks added for readability; enter the URL on one line, with spaces between scopes.)
Method 3: PowerShell
Run the Option A script with scope = "openid profile email offline_access User.Read Mail.Send Mail.Read". If you already granted Option A, upgrade the existing grant instead:
$grant = Get-MgOauth2PermissionGrant -Filter "clientId eq '$($speya.Id)' and consentType eq 'AllPrincipals'"
Update-MgOauth2PermissionGrant -OAuth2PermissionGrantId $grant.Id `
-Scope "openid profile email offline_access User.Read Mail.Send Mail.Read"
Each user still chooses their own level in Speya, so users who prefer Send only can keep it even when Mail.Read is approved.
Optional controls
Tenant-wide consent lets every user connect by default. These standard Entra controls let you narrow, monitor or withdraw access.
Control | Where | Effect |
Limit to specific users | Enterprise apps › Speya Mail (Prod) › Properties › Assignment required? = Yes, then Users and groups › add a security group | Only assigned users can connect their mailbox. |
Conditional Access | Entra ID › Protection › Conditional Access › target the Speya Mail (Prod) app | Require MFA, compliant devices or named locations for the connection. |
Monitor sign-ins and consents | Entra ID › Monitoring › Sign-in logs and Audit logs (activity "Consent to application") | See who connected and when. |
Mailbox auditing | Microsoft Purview › Audit (Send, MailItemsAccessed) | Trace mail sent and read through Speya per user. |
Revoke for one user | User removes Speya Mail (Prod) at myaccount.microsoft.com, or disconnects in Speya under Settings › Email › Disconnect | Stops sending and reply capture for that user immediately. |
Revoke for everyone | Enterprise apps › Speya Mail (Prod) › Properties › Enabled for users to sign in? = No, or delete the app's permission grants | Stops all access from your tenant. |
No Exchange application access policy or RBAC for Applications is needed: those controls apply to application permissions, which Speya does not use. No SPF, DKIM or DNS changes are needed either, because mail is sent from the user's own mailbox through Microsoft 365.
How Speya handles your data
The full terms are in section 2.4 (Microsoft 365 / Outlook integration) of the Speya privacy policy. The key points for your review:
What is stored: emails users send through Speya (recipients, subject, body, attachments, metadata) and, with Send and capture replies, the replies to those emails. Nothing else from the mailbox is stored.
Non-reply messages: checked in memory only to see if they are a reply, then discarded. They are never stored, logged, read by a person or used for any purpose.
No model training: Microsoft 365 data is never used to train or improve AI models and never added to Speya's supplier database, including in anonymised or derived form.
No resale or advertising: data is not sold, rented or shared with advertisers or data brokers.
Location: stored in Google Cloud Platform in the EU, encrypted at rest and in transit. Your mailbox stays in your own tenant's data residency region. Where your organisation enables a US-hosted AI provider, reply content is sent there for processing only (see policy section 8).
Human access: Speya staff do not read mailbox data, except with the user's explicit consent (for example a support case), for security investigations, or where required by law.
Retention and deletion: kept for the life of the Speya account. Disconnecting stops access immediately; deletion of stored data can be requested at [email protected].
Certification: Speya Intelligence AB is ISO 27001:2022 certified.
Connecting a mailbox in Speya (for end users)
Once IT has approved the app, each user connects their own mailbox:
Sign in to app.speya.ai and open a project or start a search.
Select Connectors › [Email icon] Connect My Account
Choose an access level: Send only or Send and capture replies.
Sign in with your work account on the Microsoft page and accept the permissions shown.
Contact
For questions about this guide, a security review or help during setup, contact us. We are happy to join a call with your IT team.
Topic | Contact |
Security reviews, vendor risk assessments, ISO 27001 | |
Technical setup and integration support | |
Data protection and deletion requests | |
General questions |
Help center: intercom.help/speya · Security overview: speya.ai/security · Privacy policy: speya.ai/legal/privacy-policy
Speya Intelligence AB · Reg. no. 559355-9585 · Hästholmsvägen 32, SE-131 30 Nacka, Sweden · speya.ai