Permissions reference

The Microsoft 365 permissions Clad holds, what each allows, and how to revoke it.

Every grant is made and managed from your existing Microsoft 365 admin consoles.

Granted once when an administrator approves the Clad app.

Permission	Type	Allows	Scope
`openid`, `profile`, `email`, `User.Read`	Delegated	Sign in and read the employee's name and email address	The signed-in employee
`offline_access`	Delegated	Keep an employee signed in between sessions	The signed-in employee
`Sites.Selected`	Application	Read and write SharePoint content	The sites you grant

Mail access is granted in Exchange rather than through consent, so it can be limited to a group.

Revoke: Enterprise applications → Clad for your organization → Properties → Delete. This removes all consent, sign-in and SharePoint access.

Exchange Online role assignments

Granted in Email, scoped to the members of your mail access group.

Role	Allows	Scope
`Application Mail.ReadWrite`	Read messages and attachments; create drafts	Group members' mailboxes
`Application Mail.Send`	Send email as the mailbox owner	Group members' mailboxes

Revoke: see Remove mail access. To remove one employee, take them out of the group.

Granted per site in SharePoint.

Role	Allows	Scope
`read`	Read documents and folders	That site only
`write`	Read documents, and create or update documents and folders	That site only

Revoke: see Remove a site.

Clad's activity appears in your tenant's own logs under the Clad for your organization's name application:

Microsoft Entra ID → Sign-in logs → Service principal sign-ins for Clad's access to Graph.
Microsoft Entra ID → Sign-in logs → User sign-ins for employee sign-in to Clad.
Microsoft Purview → Audit for mailbox and SharePoint activity, including messages sent.