Microsoft 365 integration with no data leaving your tenant
Excel on SharePoint is your database, Outlook is your task list and Teams is where decisions get made. We join those into one process through Microsoft Graph: the team opens the same file and the same channel as before, while the data gets one source and one place it is written to. Permissions come described so your administrator approves them once and you can revoke them with a single click.
- 2 permission typesdelegated, where the app acts on behalf of the signed-in person, and application, where it runs in the background with nobody logged in. Automation needs the second kind, and those are always approved by the tenant administrator. Microsoft Graph documentation
- 14 daysfrom the workshop to the first automation running on your tenant, on your own files and your own mailboxes
- 2 to 6 weeksis how long a full rollout usually takes, depending on how many systems from outside Microsoft enter the process
- 0 recordsleave your environment on processes that can be closed inside Microsoft Graph, Power Automate and your own Azure subscription
The problem
How much of your process lives in a mailbox and in a Teams chat?
Orders sit in an Excel file on SharePoint. Somebody opened it in the desktop app, so the file is locked and the next person makes a copy on OneDrive. Customer requests sit in Outlook, in the mailbox of one person who has just switched on an out of office reply. The discount for a large client was agreed in a Teams chat, in a thread nobody will find again.
This is not a tooling problem. Microsoft 365 already has everything this process needs. The problem is that the process is written down nowhere: there is no entry point, no owner for the task, no record of who approved what and at what time. Excel will not object when two people type in the same order, and Teams will not pass a decision to the CRM.
In larger companies there is a second thing smaller ones do not have. Microsoft 365 is the corporate standard and nothing is allowed to leave it. Every automation idea runs into one question from the security team: what exactly will this app read, and who gave it permission. Without an answer the project never starts, however well it adds up on paper.
There is no invoice for the mess, because you already pay for the Microsoft 365 licences. Instead of an invoice there is a queue. The Microsoft Graph documentation describes two kinds of permission: delegated, on behalf of the signed-in person, and application, where the app works in the background. Automation needs application permissions, and those are always approved by the tenant administrator. That is why a process technically ready in 14 days can spend a third week stuck on the question of what exactly to ask IT for.
- The order file has three versions and nobody knows which one is true
- A task exists only as an email in one person's mailbox
- A decision was made in a Teams chat and sits in no system at all
- A Power Automate flow runs under the account of somebody who left the company
- The rollout is in its third week of waiting for the administrator, because the request is vague
Why now
What changed, so this can be done without moving data out of Microsoft?
Microsoft Graph is a single point of access to Outlook, Teams, SharePoint, OneDrive and Excel. One detail decides the rest: an Excel file held on SharePoint or OneDrive is read and written as a table, row by row, rather than downloaded and uploaded again as a file. The team opens the same workbook as before, only now the rows arrive on their own and nobody has to close it.
Power Automate is already in your licence and for plenty of jobs it is enough: an approval, a notification on a Teams channel, a write to a SharePoint list, a file into a library. When that is the case we say so. It runs out when the process needs an HTTP or custom connector, which means a Power Automate Premium licence, when it needs sensible retries after a failure and a log of them, or when the flow has to belong to the company rather than to the account of the person who built it.
At that point the logic moves to an external orchestrator, n8n or Make, and Microsoft 365 stays the place where the team works and where the result is written. The split is simple: what happens inside Microsoft stays in Power Automate, what crosses into the CRM, accounting or the shop goes to the orchestrator. We set that boundary in the workshop, on your processes, rather than deciding it up front.
How narrowly access can be granted has changed too. We register the app in your own Entra ID and scope it to named resources: selected SharePoint sites instead of all of them, and specific mailboxes in Exchange Online through an application access policy. The administrator sees a list of permissions with a reason for each one, approves it once and can take it away with a single click, without raising a ticket with us.
The AI agent comes last. A flow will move data, but it will not answer the question of how many September orders still have no invoice. BOND, our company AI agent, answers that in a plain sentence in 5 to 10 seconds, reading the same Excel tables, the same SharePoint lists and the same warehouse. You ask in Teams, in the place where you already are.
What changes
What does a team that stays inside Microsoft 365 get?
Excel becomes the interface and stops being the database
Rows land in a table on SharePoint through Graph, validated on the way in, with version history kept in the library. The team opens the same file and the same tabs, and stops retyping data out of emails.
Writes go to the table, not to the file, so nobody has to close Excel or keep a copy on OneDrive
Outlook stops being the task list
An email carrying an enquiry or an invoice goes into the right queue with a label, an owner and a due date. The request lives in a system rather than in the mailbox of somebody on holiday.
The task has an owner and a deadline even when its usual handler is out of office
A decision made in Teams gets recorded
The approval goes out as a card on a channel or in a direct message, and the result lands in a SharePoint list, in Excel or in the CRM. The conversation stays on the channel, the record stays in the system.
Who approved what, and at what time, stored outside the chat
A request your administrator can approve on the spot
You get a list of permissions with a reason for each resource separately, scoped to named sites and named mailboxes. The security team reviews something concrete instead of a blanket request for tenant access.
One approval in Entra ID instead of three weeks of questions by email
The process belongs to the company, not to an employee account
The app is registered in your own Entra ID and the flows do not sit under the personal account of whoever built them. The person who built it leaving does not stop the process.
The app registration and the permission documentation stay with you after the rollout
Questions about data asked in plain English in Teams
How many orders are waiting for payment, which cases have been open longer than 5 days, how many invoices arrived this week. The AI agent answers from your data, in the same window the team is talking in.
An answer in 5 to 10 seconds, with no second system to log into
And in your company
What if our IT will not let data leave Microsoft 365?
Four sentences we hear on almost every first conversation about Microsoft 365.
None of them is a reason to put the subject off. The first two get settled in the workshop, the next two by agreeing access and licences, all of it before the first line of code.
We have Power Automate in our licence, why bring anyone in?
If the process sits inside Microsoft and runs on standard connectors, we say it plainly: you do not need us for that. We come back to the conversation when the flow needs an HTTP or custom connector, which means a Premium licence, when it starts reaching into the CRM and accounting, or when it runs under one person's account and nobody knows what happens the day they leave.
Our Excel file has forty tabs and VBA macros.
Macros do not run in Excel in the browser or through Graph, and that is the first thing we check in the workshop. Usually there is no need to rewrite the whole file: we lift out the part that has to happen on its own and leave the rest as a sheet for manual work. Sometimes the conclusion is that the macro is best left alone.
No data of ours may leave Microsoft 365.
Then we close the whole process inside the tenant: Graph, Power Automate and, where compute is needed, a service in your own Azure subscription. The AI model can run in the same place. We write that into the workshop as a project constraint and pick tools to fit it, with the personal data in scope agreed under <a href="https://eur-lex.europa.eu/eli/reg/2016/679/oj" rel="noopener">GDPR 2016/679</a>, instead of proposing something your security team was never going to sign off.
IT will not give an outside party access to our mailboxes.
It does not have to. The app is registered in your own Entra ID, your administrator grants the permissions, and we scope them to named mailboxes and selected SharePoint sites. Wherever read only access is enough, read only is what we work with. You take the access away yourselves, with no ticket raised with us.
- Microsoft 365
- Outlook, Teams, SharePoint, OneDrive, Excel, Planner, Entra ID
- Microsoft layer
- Microsoft Graph, Power Automate, Teams bot, services in your Azure subscription
- CRM
- HubSpot, Pipedrive, Salesforce, Zoho
- Finance and sales
- Xero, QuickBooks, Sage, sevDesk, Stripe, Shopify, WooCommerce
- Data and reporting
- BigQuery, Google Sheets, GA4, SQL databases
- Outside Microsoft
- Slack, Notion, ClickUp, Jira, Asana, Google Workspace, n8n, Make
What your automation actually needs from Microsoft 365
The most common jobs and what you really have to ask for: a permission in Entra ID, a licence, or both. Worth knowing before the project starts, because some of it fits inside what you already own and some of it costs one approval from your administrator.
| The job | What it needs | Who approves it |
|---|---|---|
| A notification on a Teams channel and a write to a SharePoint list | standard connectors, included in the Microsoft 365 licence | nobody, what you already have is enough |
| Reading a mailbox with nobody signed in | an application permission in Entra ID, scoped to named mailboxes by an access policy | the tenant administrator, once |
| Writing to an Excel table on SharePoint | the file on SharePoint or OneDrive plus permission to the selected sites | the tenant administrator and the site owner |
| A flow with an HTTP or custom connector | a Power Automate Premium licence | whoever signs off licence spend |
| A bot answering on a Teams channel | a Teams app published to the organisation catalogue | the Teams administrator |
| An AI model working on tenant data | a service in your Azure subscription or a licence from Microsoft | the administrator and the budget holder |
| A VBA macro in a file on SharePoint | it will not run in the browser or through Graph, so another route has to be chosen | a decision taken in the workshop |
Microsoft changes permission names and licence scopes without notice, and some of this looks different on Business plans and on Enterprise ones. We check it in the workshop, on your tenant, before anyone goes to the administrator for approval.
How we work
Five steps from a process living in email to a process that records itself
Every step ends with something you can judge before you decide on the next one.
Workshop
We open the files, mailboxes and channels the process actually lives in, with you. We look for the entry point, the owner of the task and the place the decision gets made. We also write down the constraints: what may not leave the tenant, who grants permissions and which licences you hold today.
Design: the layer and the permissions
We settle what stays in Power Automate and what moves to an orchestrator outside Microsoft. Out of that comes the permission list for the Entra ID app registration, with a reason for each resource and a scope narrowed to named sites and mailboxes. That document goes to the administrator before we build anything.
Pilot on one site and one mailbox
We run the first automation on a narrow scope, alongside the process that carries on the old way. We test it against the last few weeks of real data, including messages with attachments in odd formats and the busiest month of the year. That is usually 14 days from the workshop.
Production and handover
We widen the scope and switch the process to production with an execution log and failure alerts in Teams. The app registration, the flows and the permission documentation stay with you. The person responsible learns to change what changes most often: thresholds, recipients, deadlines.
Measurement at 30 and 90 days
We look at what is really happening: how often the process broke, how many cases went to the manual queue, how long the work now takes that a person used to do. At 90 days we review the permissions as well and revoke the ones that turned out to be unnecessary.
Before and after
How the week changes for the person who keeps this process running
Before
- Mornings go on retyping orders out of email into an Excel file on SharePoint
- Asking a colleague to close the file, so one row can be added
- Searching the Teams chat for what was agreed with a client two weeks ago
- Friday means gluing a board report together out of three files by hand
After
- The order from the email is in the table before the laptop is open
- The write goes to the table, so the file does not have to be free
- The Teams approval leaves a record in the system: who, what and when
- The report refreshes itself and speaks up when a source stops responding
The first automation is visible 14 days after the workshop. We judge the effect on the whole process at 30 days, and at 90 days we check whether the permission scope is still the smallest one possible.
For the person signing this off
What the operations director and the person accountable for IT get out of it
The conversation with the security team ends on a permission list rather than on an exception to policy. You know what the app reads, which sites and mailboxes it is scoped to, who granted that and how to take it back. On processes that can be closed inside the tenant, data does not leave Microsoft 365, so there is nothing to explain in a security questionnaire.
The second point is for the board. The process stops depending on one person's account, the flow does not die when they leave, and you know how many times a month something broke and how many cases went to the manual queue. You do not know that today, because Excel keeps no statistics and Teams reports no decisions.
- The app registered in your own Entra ID, permissions documented per resource
- Access scoped to named mailboxes and sites, not to the whole tenant
- Revoking access is one click on your side, with no ticket raised with us
- Flows and documentation stay with you, including after we stop working together
- The workshop costs EUR 3,500 net per week, so the first step fits a budget without a board resolution
What it costs
The workshop has a published price, the rollout is quoted after it
The process workshop costs EUR 3,500 net per week and runs from one to seven weeks. One Microsoft 365 process usually needs a single week, because the files and mailboxes are right there in front of us. We quote the rollout after the workshop, once it is clear how many systems are involved, how many permissions have to be granted and what state the data in Excel is in.
You already pay for Microsoft 365, so automation built on standard connectors and Microsoft Graph adds no tool cost. Where the process needs a Power Automate Premium licence, an orchestrator outside Microsoft or a service in Azure, you settle that bill directly with the vendor, with no margin from us. The same goes for the language model when an AI agent is in scope, where a single query costs the provider roughly EUR 0.005 to 0.07.
You can buy the workshop and stop there. The document is written so your IT team can carry it out without us: the process map, the permission list to approve and a ruling on where the logic belongs.
Process workshop
EUR 3,500 net
per week, and one Microsoft 365 process is usually one week
A self-contained piece of work. It ends with a process map and a permission list your IT team could execute with their own hands, including without us.
- A review of the files, mailboxes and channels the process lives in
- The map: entry point, task owner, the place the decision is made
- A ruling on what stays in Power Automate and what goes outside Microsoft
- The Entra ID permission list with a reason for each resource
- A licence check: what fits inside what you own and what needs a higher plan
- The metrics to measure at 30 and 90 days
- Most popular
Workshop and Microsoft 365 rollout
Quoted after the workshop
scope follows from the number of systems, mailboxes and sites in the process
The option most companies choose. The first automation 14 days after the workshop, the full rollout in 2 to 6 weeks.
- Everything in the workshop
- Integration through Microsoft Graph: Outlook, Teams, SharePoint, OneDrive, Excel
- Writes to Excel tables and SharePoint lists, validated on the way in
- Approvals in Teams with a record in the system, an execution log and failure alerts
- Flows and the app registration on your own tenant, with the documentation
- Training for the person responsible, so thresholds and deadlines change without us
Microsoft 365 and an AI agent
Quoted after the workshop
for companies asked about this data a dozen times a day
Everything in the rollout plus BOND, which answers questions about company data in Teams, in plain sentences.
- Everything in the Microsoft 365 rollout
- An AI agent reading your Excel tables, SharePoint lists and data warehouse
- A question on a channel or in a direct message, an answer in 5 to 10 seconds
- Access through the Microsoft 365 accounts the team already has
- A BOND rollout usually takes around 2 months, counted from the data being ready
The workshop ends with a document that stands on its own. If it turns out that one Power Automate flow on the licence you already hold is enough, we say so and show you how to build it, instead of selling you a rollout you do not need.
Frequently asked questions
What is a Microsoft 365 integration?
It is joining Outlook, Teams, SharePoint, OneDrive and Excel into one process through Microsoft Graph, with a single entry point, a single source of data and a record of who approved what. The team carries on working in the tools it knows. What changes is underneath: rows arrive on their own, tasks have owners, and decisions taken in a chat leave a trace in a system.
When is Power Automate enough and when do you need an external orchestrator?
Power Automate is enough when the process sits inside Microsoft and runs on standard connectors: an approval, a channel notification, a write to a SharePoint list, a file into a library. An orchestrator comes in when you need an HTTP or custom connector, when the CRM, accounting or the shop are involved, when you need retries after a failure with a log of them, or when the flow has to belong to the company rather than to its author's account. We set that boundary in the workshop.
Which Entra ID permissions do you need and who grants them?
We register the app in your own Entra ID and prepare a permission list with a reason for each resource separately. Application permissions, the ones the process runs on with nobody signed in, are approved by your tenant administrator. We scope them to named mailboxes and selected SharePoint sites rather than to the whole tenant, and wherever it is possible we work in read only mode.
Will our data leave Microsoft 365?
On most processes it does not have to. Graph, Power Automate and a service in your own Azure subscription let the whole thing stay inside the tenant, and that is how we build it in companies with a hard policy on this. Where the process has to touch a CRM or an accounting system outside Microsoft, the workshop settles exactly which fields go out and what for, rather than sending everything just in case.
Do we have to buy extra licences?
Not always, and we check it in the workshop before anything starts. Standard connectors, SharePoint lists, Teams notifications and access through Microsoft Graph fit inside what companies usually already hold. A higher plan is needed for an HTTP or custom connector in Power Automate, and a separate bill for a service in Azure. Scopes differ between Business and Enterprise plans, so we work it out on your tenant.
Does the team have to stop working in Excel?
No. Excel on SharePoint or OneDrive stays the interface, because people know it and talking them into a new tool costs more than the rollout itself. What changes is that the write goes to the table through Graph, row by row, so the file does not have to be closed and no copy appears on somebody's drive. Version history stays in the library.
What about VBA macros and files opened in the desktop app?
Macros will not run in Excel in the browser or through Microsoft Graph, so that is one of the first things we check. Usually there is no need to rewrite the whole file: we lift out the part that has to happen on its own and the rest stays a sheet for manual work. A file open in the desktop app does not block a write to the table, because that write travels a different route than editing the file.
How long does a Microsoft 365 integration take?
A week of workshop, then 14 days to the first working automation and usually 2 to 6 weeks to the full rollout, depending on how many systems are involved. In practice the date hangs on one thing: how quickly the administrator approves the permissions, which is why we prepare that list straight after the workshop. We run at most two rollouts at a time, so we agree the start date in the consultation.
Tell us where your process runs out inside Microsoft 365
The free consultation takes 30 minutes. You tell us which file and which mailbox matter most to you and what breaks in them most often. We tell you what can be done with Power Automate alone on the licence you already hold, what needs the administrator's approval, and what has to wait until the data comes out of Excel. You do not have to share your tenant or any files at this stage.
We run at most two rollouts at a time, so that someone is genuinely sitting on each of them.
Book a free consultationPS. If anyone in your company asked which version of that file is the current one this week, or went hunting through a Teams chat for what was agreed, that is exactly the problem. Excel and Teams stay where they are, because that is where the team works. What changes is that the process gets one source of data and records who approved what. That is where the workshop starts.