Security & your data

What the app can and can't do

It manages mailbox and calendar permissions through Exchange Online admin commands; it has no permission to read email content or calendar items, and never receives your users' passwords.

Permissions it needs and why

Exchange.ManageAsApp lets your Entra app registration use Exchange Online admin commands. Exchange Recipient Administrator limits its role to recipient administration.

Optional Graph Calendars.ReadWrite is needed only if the optional Graph calendar mode is used.

Where data lives

Data lives in Freshworks app storage in your account's data centre: run history of the last 50 runs and app health status. Results are recorded in ticket notes. Nothing is sent to us.

Credentials

Credentials are encrypted secure settings, never shown again. The webhook secret is shown once; the alert webhook URL is hidden after saving. Certificate sign-in is supported.

Controls

• Approval required
• Protected mailboxes matched by every alias
• Tenant domains only
• Guests and contacts blocked
• Change limit
• Dry run
• Risky permissions off by default

Transport

HTTPS only. The Freshservice API key is only ever sent to *.freshservice.com. Microsoft endpoints are fixed per cloud.

Responsible disclosure

Report security issues through the support form on our Support page.