Integration overview
Connect employee mailboxes, Microsoft sign-in and SharePoint sites to Clad.
The Microsoft 365 integration has three capabilities. Each is enabled separately, by the administrator who owns that area, and each is limited to what you grant.
| Capability | What Clad can do | Scoped by | Guide |
|---|---|---|---|
| Read new mail, and send mail from employee mailboxes after one of your employees approves each email | A mail-enabled security group you manage | ||
| Single sign-on | Let employees sign in to Clad with their Microsoft account | Your Entra ID assignment and Conditional Access policies | Single sign-on |
| SharePoint | Read and file documents in specific sites | Individual site grants | SharePoint |
What administrators approve
Clad registers an application for your organization alone. Approving it grants only sign-in and the ability to be granted SharePoint sites later. It does not grant any mail access. Mail access is granted separately in Exchange Online and is limited to the members of a group.
Why mail is not on the consent screen
A tenant-wide Mail.ReadWrite consent in Entra ID would apply to every mailbox in your
organization, and would override any group limit. Granting mail access only through Exchange
RBAC for Applications keeps it scoped to the mailboxes you choose.
Setup sequence
Prerequisites
Send Clad your Microsoft tenant ID. Confirm administrator roles, install the PowerShell modules, and prepare Exchange Online the day before.
Approve the Clad app
A Global Administrator or Privileged Role Administrator opens the setup link Clad sent and grants consent once.
Enable capabilities
Set up Email, Single sign-on and SharePoint, in any order.
Verify the connection
Confirm the scope from your side, then Clad runs a read-only check.
Clad is operated by Docshield Inc. · Wilmington, DE · New York, NY