Teamflect integrates deeply with Microsoft 365 to provide a connected and seamless experience for its users. This integration is made possible through the Microsoft Graph API, which enables secure access to essential data and services across the Microsoft ecosystem.

When your organization installs Teamflect, Microsoft asks an administrator—or, in some cases, an end user—to grant Microsoft Graph permissions.

These permissions allow Teamflect to integrate securely with Microsoft 365 services such as Microsoft Teams, Outlook, Microsoft Entra ID, and Microsoft To Do.

This article explains:

Teamflect follows Microsoft's principle of least privilege, requesting only the permissions required for the features your organization chooses to use.

The Microsoft Graph API is a unified endpoint provided by Microsoft that allows developers to access programmatically:

It is crucial in enabling secure data exchange between third-party applications and Microsoft 365 services.

Microsoft Graph supports two permission models.

Delegated permissions allow Teamflect to act on behalf of the currently signed-in user.

This means:

These permissions are typically used for user-specific experiences such as:

Application permissions allow Teamflect to perform background or organization-wide operations without requiring an individual user to be signed in.

These permissions are used for administrative capabilities such as:

These capabilities cannot be implemented using delegated permissions because Microsoft only exposes these APIs through application permissions. Administrator consent is therefore required.

This is one of the most common questions we receive from IT and security teams.

Whenever Microsoft allows a feature to operate using delegated permissions, Teamflect uses delegated permissions.

However, some Microsoft Graph APIs are only available through application permissions because they perform organization-wide operations that cannot depend on a particular user being signed in.

For example:

This follows Microsoft's recommended security model and principle of least privilege.

Third-party applications like Teamflect require specific Graph API permissions to:

Microsoft Graph supports two permission models:

Teamflect follows Microsoft's principle of least privilege and uses delegated permissions whenever a feature can operate in the context of the signed-in user. However, some Microsoft Graph APIs are only available through application permissions.

Application permissions are required for features such as:

These capabilities cannot reliably operate using delegated permissions because they must continue running even when no administrator is signed in.

For more information, see Microsoft's documentation on the difference between delegated and application permissions here.

When your organization installs Teamflect, Microsoft asks you to approve a set of permissions. This is completely standard for any app that works inside Microsoft Teams and Outlook.

This guide explains each permission in everyday language, so your IT team and end-users know exactly what they’re agreeing to.

Required permissions are needed for Teamflect to function at all. Optional permissions unlock specific features — if you skip them, everything else still works normally.

These are the basics Teamflect needs to know: who you are, who’s in your organization, and how to show people inside the app.

These permissions connect Teamflect to your calendar and Microsoft To Do. They’re off by default and only activate when your admin enables the related feature.

Here's a quick video outlining the steps for end-users to grant Teamflect access to their calendar later on:

This permission gives Teamflect a read-only view of your org chart data.

These permissions are only relevant if your organization uses Excel-based goal tracking — for example, linking a goal’s progress to a value in a shared spreadsheet.

These permissions are only needed if your organization wants to pull live KPIs and metrics from Power BI Scorecards into Teamflect goals.

Here’s the short version:

If your organization decides it no longer needs a specific optional permission, your IT administrator can remove it at any time through Microsoft Entra ID (formerly Azure AD). Only the related feature will stop working — everything else continues normally.

Teamflect takes data privacy seriously and adheres to the following principles:

Teamflect is fully GDPR compliant, aligning with global privacy laws and frameworks. We:

Non-compliance with GDPR carries severe penalties - this ensures that Teamflect remains vigilant and transparent in how it handles data.

Only for features that Microsoft requires to run using application permissions, such as directory synchronization and other tenant-wide administrative capabilities.

Yes. Core Teamflect functionality works without tenant-wide admin consent. Features that depend on organization-wide Microsoft Graph permissions—such as automatic directory synchronization, calendar integration, and certain administrative automations—remain unavailable until administrator consent is granted.

Yes. Permissions can be reviewed, modified, or revoked at any time through Microsoft Entra ID. If a permission is removed, only the related Teamflect functionality is affected.

No. Teamflect does not request permissions to read emails or Microsoft Teams chats and cannot access them.

Yes. Teamflect requests delegated permissions whenever Microsoft supports them and only requests application permissions when Microsoft's APIs require app-only access for the relevant functionality.

For more details, visit the 👉 Teamflect Trust Center. You can explore our security practices, compliance certifications, and data handling policies in depth.