Approve Narella for your organization

Someone on your team wants to connect their Microsoft 365 mailbox to Narella. Microsoft asks an administrator to approve the permissions once; after that each person still connects their own account themselves.

You don’t need a Narella account to approve this.

What Narella asks for

Delegated permissions only — Narella acts as the person who signed in, never as your tenant.

• Read your mail, and save drafts Mail.ReadWrite
  Narella reads who you write to and when, and saves a draft you asked for in your Drafts folder. Microsoft has no draft-only permission, so saving a draft needs the read-write one.
• Send a message you have approved Mail.Send
  Only a message you have read and pressed send on. Narella never writes to anyone on its own.
• Read your calendar Calendars.Read
  Who you met and when. Narella never changes, creates or cancels anything in your calendar.
• Read your saved contacts Contacts.Read
  The names, addresses and companies already in your Outlook contacts.
• Read the people Outlook already ranks for you People.Read
  Outlook keeps its own list of the people you deal with most; it fills in colleagues you have never saved as a contact.
• Read your name and email address User.Read
  So Narella can label the account you just connected, and nothing else.
• Keep working after you close the window offline_access
  Narella refreshes in the background, on your Mac, until you disconnect the account.

What it does not ask for

• No access to anyone else's mailbox — each person connects their own account.
• No files, Teams, SharePoint or OneDrive.
• No application permissions: Narella only ever acts as the signed-in person.

Where the data goes

Narella is a Mac app. Mail, calendar and contacts are read on your colleague’s own computer, and message bodies never leave it — Narella’s servers never receive them.

• Each person signs in from the app on their own Mac; the token lives in that Mac’s Keychain.
• Nobody at Narella can read your colleague’s mail, and no server-side job touches the mailbox.
• Revoking the approval in Entra, or disconnecting in the app, stops Narella getting any new access. An access token already issued stays valid until it expires — up to about an hour — unless your tenant uses Continuous Access Evaluation.