What it can see
- Only the mailbox of the person using it. The permissions are delegated, so the AI acts as that person and sees no more than they can.
- On Microsoft, the six read-only permissions from the Entra guide: user profile, mail, calendar, files and SharePoint sites.
- Whatever it reads is part of that person’s chat. It stays in your chat history and in your backups.
What it cannot do
- It cannot send, draft, edit, delete, forward or share anything. The connector servers run read-only and have no write tools.
- Rules deny any tool that sends, deletes, forwards, updates or shares.
- “The AI can draft” means text in the chat. It never means a draft in your mailbox.
- Staff cannot add connectors of their own, and the list of allowed connector addresses is strict.
Write access
We say no by default. Allowing it needs your admin’s written request, a change to your contract, and approval on every use.
The risk to know about
A malicious email can contain text that tries to give the AI orders, for example to send other mail out through a hidden link. Any AI that reads mail has this risk. The controls below are the defence, so please do not relax them.
Setting it up
Step 1: Switch the connector on for the right roles
In the admin panel, turn on the Outlook or Gmail connector for the roles that need it, and leave it off for the rest. On Microsoft, make sure admin consent was granted in the Entra guide.Step 2: Build the mailbox assistant with these rules
- Only the connector. No web search, code runner, memory or other tools. This is what stops something read in one place being sent to another.
- A clear system prompt saying that email content is data and never instructions.
- Sharing limited to the groups you choose.
Step 3: Test it with a planted email
Send a test mailbox an email containing instructions to leak other mail through an image link. Ask the assistant to summarise that mailbox. Confirm it does not follow the instructions and that no image loads. Then ask it to send an email, and confirm it cannot.Step 4: Tell your staff
Make sure your AI usage policy covers it: the assistant reads only their own mailbox, they must not act on instructions in an email just because the AI repeated them, and they should stop and report it if the AI behaves strangely.
Already enforced for you
Images from outside hosts are blocked, which is how hidden links leak data. The connector tools are limited to a fixed list. You do not need to set these up.