Skip to main content
This guide is for Microsoft Entra ID directory administrators. It lists every permission Hebno requests for OneDrive, SharePoint, Outlook, Outlook Calendar, Microsoft Teams, OneNote, Dynamics 365 Sales and Dynamics 365 Business Central, and shows how to approve them once for your whole tenant. Members connect their own accounts. For their steps, see Microsoft 365.

​
How Hebno uses your tenant

Every search, read and write runs as the signed-in member, under that member’s own Microsoft permissions. Hebno cannot open a file, message, event, notebook or record the member cannot already open. Consent is per integration. Approving Teams does not approve SharePoint, and approving SharePoint does not approve Outlook. Each integration’s Enable for the organisation button requests only its own permissions.

​
Permissions by integration

All permissions are delegated. User.Read, email, openid and offline_access are requested with every integration to identify the connection and maintain sign-in.

​
OneDrive

​
SharePoint

​
Microsoft Teams: meetings

​
Microsoft Teams: channels and chats

​
Outlook

Hebno does not move, edit or delete email.

​
Outlook Calendar

Hebno does not request Calendars.ReadWrite.Shared. It cannot read or edit a colleague’s calendar beyond what that colleague has shared with the member.

​
OneNote

Hebno does not edit or delete existing notes.

​
Dynamics 365 Sales

Replace <org> with your environment address. Regional environments use their own host, for example crm4.dynamics.com.

​
Dynamics 365 Business Central

Hebno never posts a document, whatever the user’s permission sets allow. Organisation grants never include Mail.Send, Calendars.ReadWrite, ChannelMessage.Send or Notes.Create. Each member approves those from Allow sending, Allow invitations, Allow posting and Allow page creation under Settings → Connections.

​
Roles required

The account that grants consent must belong to the same Microsoft tenant as your members.
1

Allow the integration in Hebno

An owner or admin opens Admin → Connectors → Catalogue and confirms the integration is set to Allow.
2

Start the grant

On the integration’s card, select Enable for the organisation.
3

Sign in as a directory administrator

Sign in with a Global Administrator or Cloud Application Administrator account.
4

Review and accept

Check the permissions listed against the tables above, then select Accept. Microsoft returns you to Hebno and the card shows Organisation-wide.
Repeat for each integration. Members then see Enabled by your organisation on that integration under Settings → Connections and connect without a Microsoft consent screen. Each member still connects their own account. For Dynamics 365 Sales, the card requests your environment address first, so the grant names the right user_impersonation scope. For Business Central, grant consent before an admin connects the organisation, see Business Central.
Admin consent removes a prompt. It does not widen access. Microsoft still enforces each member’s own permissions on every request.

​
Conditional access

Hebno signs members in through the standard Microsoft sign-in, so your conditional access policies apply as they do for any enterprise application. Multi-factor authentication, compliant device and location rules all run at sign-in and when a token refreshes. When a policy requires a fresh sign-in, the member sees Sign in to Microsoft again to keep using your files. and reconnects from Settings → Connections. The connection record and any project links are retained while they do.

​
Teams admin centre settings

Teams transcripts depend on two meeting policy settings in the Teams admin centre: If your policy blocks apps from transcripts, Teams items in Hebno show meeting details and Copilot notes only, with the line “Your organisation has turned off transcript access for apps.” Transcription must also be on during the meeting. Teams retains meetings and their artefacts for 60 days after they end, so Hebno lists the last 60 days.

​
Revoke access

1

Return to personal approval in Hebno

On the integration’s card under Admin → Connectors → Catalogue, select Return to personal approval. The integration is no longer treated as approved for the organisation.
2

Remove the grant in Entra

In the Microsoft Entra admin centre, open Enterprise applications, find Hebno, and delete the permission grant under Permissions.
3

Revoke member connections if needed

Open Admin → Connectors → Connections and select Revoke on any member’s connection. The change is recorded in Admin → Logs.
Removing a grant in Entra does not delete members’ connections. Members approve again the next time they use that integration, and their other Microsoft integrations are unaffected.

​
Verify the setup

  1. As a test member, open Settings → Connections and confirm each approved integration shows Enabled by your organisation.
  2. Connect the account and confirm no Microsoft consent screen appears.
  3. Open a chat, select + → Sources, and pick the integration to browse an item.

​
Troubleshooting

Hebno stores access and refresh tokens encrypted. It never stores a member’s Microsoft password.