Docs
Microsoft 365

How it works

The Microsoft 365 components involved, what each one does, and what data moves between them.

Clad connects to your Microsoft 365 tenant through an application that Clad registers in Microsoft Entra ID for your organization alone. It has its own application ID and is not shared with any other Clad customer. Your administrators approve it once, then decide what it can reach.

Components

ComponentWhere it livesRole
Clad applicationClad's Microsoft Entra ID tenantThe identity Clad uses to call Microsoft Graph, dedicated to your organization. Appears in your tenant as the Enterprise application Clad for your organization's name after approval.
Mail access groupYour Exchange OnlineA mail-enabled security group. Clad works with its members' mailboxes.
Exchange role assignmentsYour Exchange OnlineGrant Clad mail access, scoped to the group.
SharePoint site permissionsYour SharePoint OnlineGrant Clad access to the sites it works in.
Clad environmentClad (AWS, United States)An environment dedicated to your organization, in its own AWS account with its own database and compute. Not shared with any other customer.

Data flow

Microsoft 365 data flowClad reads mail for the members of your mail access group, sends from their mailboxes only after one of your employees approves each email, and works with the SharePoint sites you grant, through Microsoft Graph. Employees sign in through Microsoft Entra ID.Your Microsoft 365 tenantAdministered by your IT teamYour Clad environmentDedicated to your organization · AWS, United StatesExchange OnlineMail access groupMembers' mailboxesRead; send after approvalSharePoint OnlineGranted sitesSites you grantRead and fileMicrosoft Entra IDSign-in, MFA,Conditional Access1234Microsoft GraphMicrosoft's API. Checks every request against your grants.HTTPS · TLS 1.2+5Single sign-on(OpenID Connect)Clad applicationReads mail; sends only mail anemployee has approved.Reads and files documents.No stored secret or certificate.Database and storageYour organization's data only.AES-256 encryption at rest.Clad web appEmployees sign inwith their Microsoftaccount.
Clad connects through Microsoft Graph over HTTPS. Numbers match the table below.
#DirectionWhat movesHow
1Microsoft 365 → CladNew messages and attachments in the inboxes of group membersRead through Microsoft Graph.
2Clad → Microsoft 365Outgoing emailSent from the responsible employee's own mailbox, so replies return to that employee. Each email is sent only after one of your employees approves it.
3Microsoft 365 → CladDocuments in granted SharePoint sitesRead through Microsoft Graph.
4Clad → Microsoft 365Filed documentsWritten to granted SharePoint sites through Microsoft Graph.
5Employee → CladSign-inMicrosoft Entra ID single sign-on (OpenID Connect). Passwords stay with Microsoft.

Authentication

Clad calls Microsoft Graph with the client credentials flow. It authenticates as your organization's Clad application with a federated identity credential: Clad's workload in AWS presents a short-lived token from its own identity, and Microsoft Entra ID exchanges it for a Graph access token. The application has no client secret and no certificate, and no credential is created, shared or stored in your tenant.

Clad is operated by Docshield Inc. · Wilmington, DE · New York, NY

Integration overview

Connect employee mailboxes, Microsoft sign-in and SharePoint sites to Clad.

Setup checklist

The end-to-end Microsoft 365 setup sequence, with owners and timing.

On this page

ComponentsData flowAuthentication