Approving Sigbot in Microsoft 365

1. What Sigbot asks Microsoft for

All three are delegated: Sigbot acts only for a person who signs in and connects their own mailbox. Approving Sigbot for the company does not let it read anyone else's mail.

Why not Mail.ReadBasic? It leaves out the message body, and the signature is in the body.

For each message Sigbot reads the body, sender, recipients, subject and date, to find the signature and to tell a real correspondent from a newsletter. It also checks who the person has recently written to (up to 200 sent messages). Attachments are never downloaded.

2. What it keeps, and where

• Kept: the contact details found in signatures (name, job title, company, email, phone, address, website). Senders it isn't sure about go to a review queue.
• Not kept: email bodies, subjects, recipients and headers. Only a SHA-256 hash of each message ID is kept, for 180 days, so a message isn't scanned twice.
• Where: Google Cloud Firestore in the EU, processed in London. Account sign-in data sits with Firebase Authentication, which runs in the US (DPA §6).
• Encryption: TLS in transit and encrypted at rest. Mailbox tokens are also encrypted with AES-256-GCM (Security §2).
• AI: when AI parsing is on, only the signature block (at most 4,000 characters) may be sent to Anthropic to read it. It can be switched off per account and per team (subprocessors).
• Retention: automatic, on the schedule in Security §9. Disconnecting a mailbox deletes its tokens at once.

3. Why Microsoft asked for an admin

Microsoft's default consent setting (Let Microsoft manage your consent settings) stops ordinary users from giving an outside app access to their mail. So in most companies an admin approves Sigbot once, for everyone. Microsoft's screen shows Sigbot as a verified publisher (SIGBOT LTD), with Microsoft's blue badge.

4. Approve it once for the company

You need to be a Global Administrator, Privileged Role Administrator, Cloud Application Administrator or Application Administrator.

Admin for more than one Microsoft 365 organisation? Replace organizations in the link with your company's domain or tenant ID.

Or review requests as they come

Turn on Microsoft's admin consent workflow: Entra admin centre → Enterprise applications → Consent and permissions → Admin consent settings → Users can request admin consent to apps they are unable to consent to → Yes, and choose reviewers. Your colleague then sees Request approval on Microsoft's screen, and a reviewer approves or denies it.

To limit Sigbot to certain people: Enterprise applications → Sigbot → Properties → Assignment required → Yes, then add them under Users and groups.

5. Revoke it

• For the whole company: Entra admin centre → Enterprise applications → All applications → Sigbot (Application ID 4cf71eb1-…) → Properties. Set Enabled for users to sign in? to No to stop it at once, or Delete to remove the app and every permission granted to it.
• For one person: they can disconnect Outlook in Sigbot (Import Emails → Disconnect). That deletes Sigbot's tokens for their mailbox at once.

6. Audit log and Enterprise

Every team plan keeps a year of audit log, which owners and admins can export as CSV. Enterprise adds single sign-on (Entra ID, Okta or SAML), SCIM, audit log streaming and a read-only API, set up with you on a call: book one here.

7. Questions

Security questions: security@sigbot.co. Anything else: support@sigbot.co, or book a 20-minute call. We reply within one working day.