Microsoft 365 permissions
Every Microsoft permission SimpleSign365 asks for, delegated or application, what it is used for, who must consent, plus the hosts to allow.
Last updated 28 October 2026
SimpleSign365 uses two multi-tenant Microsoft Entra app registrations. Both ask for delegated permissions only: they act as the signed-in user and never as the whole organisation. It asks for no application permissions.
Permissions
| App | Permission | Type | Used for | Why not narrower |
|---|---|---|---|---|
| SimpleSign365 Login (sign-in) | openid, profile, email | Delegated | Signing the user in with their work account: name and email address. | These are the standard sign-in scopes. |
| SimpleSign365 Mailbox (mailbox) | Mail.Send | Delegated | Sending the signing emails and reminders a user starts, from that user's mailbox. | It is the permission for sending only; it gives no access to read mail. |
| SimpleSign365 Mailbox (mailbox) | User.Read | Delegated | Learning which mailbox was connected (name and address). | It is the basic profile permission. |
| SimpleSign365 Mailbox (mailbox) | offline_access | Delegated | Keeping the connection so reminders can go out later without asking the user to sign in again. | Without it the connection would end when the short-lived access token expires. |
Consent
- Users can usually allow these themselves. In tenants that restrict user consent, an admin has to approve the mailbox app once. An admin can do that for the whole organisation atthe Microsoft admin consent page.
- Any user can remove the permission at any time in their Microsoft account (My Apps).
Publisher
Both apps are published by SimpleSoftware365 (Microsoft Partner ID 7179688). The verified publisher badge is not yet shown on the consent screen. Until it is, tenants whose consent policy only allows verified publishers show "Need admin approval", and an admin can approve the app with the link above.
We have not published a Microsoft 365 Certification or Publisher Attestation.
Hosts to allow
If your network filters traffic, allow these hosts.
| Host | Used for | Required |
|---|---|---|
| app.simplesign365.com | Sign-in | Yes |
| eu.simplesign365.com, us.simplesign365.com | The app and the signing pages, in the region that stores the office's documents | Yes (the region of your office) |
| www.simplesign365.com | This website and the check page | No |
| eu.notifications.simplesign365.com, us.notifications.simplesign365.com | System emails such as the backup sender and notices | Recommended (mail filters) |
| buy.paddle.com, cdn.paddle.com, checkout-service.paddle.com | Paying for a plan (SimpleSign365 uses Paddle) | Only to buy a plan |