Question 1

What do I need before installing?

Accepted Answer

Freshservice with the Service Catalog and Workflow Automator, Microsoft 365 with Exchange Online, a Global Administrator for the one-time Entra setup, and a Freshservice agent API key. Setup takes about 30 minutes.

Question 2

Does it work with Exchange on-premises or hybrid?

Accepted Answer

It works with mailboxes in Exchange Online. On-premises mailboxes aren't supported.

Question 3

Which Microsoft permissions does it need?

Accepted Answer

Exchange.ManageAsApp (with admin consent) and the Exchange Recipient Administrator role on your own Entra app registration. It doesn't need permission to read email.

Question 4

Can the app read our emails or calendar items?

Accepted Answer

No. It has no permission to read email content or calendar items; it only adds and removes permissions.

Question 5

Client secret or certificate?

Accepted Answer

Both work. A certificate is recommended: the private key stays in encrypted storage and certificates can last longer.

Question 6

Which Microsoft clouds are supported?

Accepted Answer

Global, US Government (GCC High, DoD) and China (21Vianet).

Question 7

Can MSPs or multi-company setups use it?

Accepted Answer

Yes. Each Freshservice account installs the app with its own Microsoft 365 tenant and settings.

Question 8

Which permissions can be requested?

Accepted Answer

Full Access, Send As, Send on Behalf, and calendar permissions (Free/Busy, Limited details, Reviewer, Editor, Author, Publishing Editor, Contributor, Owner, Delegate, Delegate incl. private items), plus organisation-wide calendar sharing. You choose which ones are allowed.

Question 9

Can we use our own wording or language in the form?

Accepted Answer

Yes. Map any dropdown text to a permission in the settings.

Question 10

Can requesters pick people instead of typing emails?

Accepted Answer

Yes. Use a Freshservice user picker (data source "All Users") or a text field; the app recognises both.

Question 11

Can we have separate forms for mailbox and calendar access?

Accepted Answer

Yes. List each form's field names in the settings, separated by commas.

Question 12

Can it remove access as well as grant it?

Accepted Answer

Yes. Removing access that's already gone counts as done.

Question 13

Can one request cover several people?

Accepted Answer

Yes, separated by commas. Up to 10 changes per request by default (configurable).

Question 14

How quickly does access appear?

Accepted Answer

The change is applied within about a minute of approval. Outlook can take up to an hour to show it.

Question 15

Can it run without a service item, e.g. from a leaver workflow?

Accepted Answer

Yes. The workflow can send the action, permission, mailbox and user in the Web Request body.

Question 16

Can agents start it without a workflow?

Accepted Answer

Yes. Moving a ticket into a group or status you choose starts it.

Question 17

What happens if a request isn't approved?

Accepted Answer

Nothing changes. The ticket gets a note explaining why and goes to your fallback group.

Question 18

What if an email address is wrong?

Accepted Answer

The request is blocked before anything changes, with a "Did you mean…" suggestion when a similar mailbox exists.

Question 19

What if someone's Freshservice email isn't in our tenant?

Accepted Answer

The app tries their primary and secondary emails. If none is in your Microsoft 365 domains, the request is blocked with a clear note.

Question 20

Can it give access to guests, contacts or distribution groups?

Accepted Answer

No. Guests, external contacts and distribution groups are blocked; mail-enabled security groups are allowed.

Question 21

How do we protect executive or HR mailboxes?

Accepted Answer

List them as protected mailboxes. They're never changed automatically, even if requested through an alias.

Question 22

Can we test it safely?

Accepted Answer

Yes. Dry run writes what would happen without changing anything, for the whole app or a single workflow.

Question 23

How do we know what happened?

Accepted Answer

Every request gets a private note listing each change with its result. The status updates automatically and runs appear on the settings page.

Question 24

How are we told if something goes wrong?

Accepted Answer

Optional alerts to Microsoft Teams, Slack or Power Automate, plus a banner on the settings page and a daily health check.

Question 25

What happens when our client secret or certificate expires?

Accepted Answer

You get reminders 30, 14, 7 and 1 days before, and an alert if it stops working.

Question 26

Does the publisher see our data?

Accepted Answer

No. Data stays in your Freshservice account and your Microsoft 365 tenant.

Question 27

Where is data stored?

Accepted Answer

In Freshworks app storage in your account's data centre: a run history of the last 50 runs and the app's health status.

Question 28

Who can see the webhook secret?

Accepted Answer

Only the admin who creates it, until the settings are saved. It isn't shown again to anyone.

Question 29

What happens when we uninstall?

Accepted Answer

The app's storage is removed. Your ticket notes stay. Delete the Entra app registration if you no longer need it.

Question 30

How much does it cost?

Accepted Answer

One flat price per Freshservice account per month, with unlimited agents and requests. Early-adopter pricing applies at launch.

Question 31

How is it billed, and can we cancel?

Accepted Answer

Through the Freshworks Marketplace, under its billing terms; you can uninstall at any time.

Question 32

How do we get help?

Accepted Answer

Use the support form on our Support page. We reply within 2 business days (UK time).

Question 33

Do updates keep our settings?

Accepted Answer

Yes. Updates keep all settings and secrets; open the settings and click Save after an update.

Questions, answered

Getting started

Requests

Safety

Results & monitoring

Security & data

Billing & support