Microsoft 365 organisation

Attach a whole Microsoft 365 tenant so that every user with a mailbox can be archived. A global administrator does this in two Microsoft screens: admin consent, then a sign-in that proves they control the tenant.

How it works

Mailgestor has a registered application with read-only application permissions: Mail.Read, Calendars.Read, Contacts.Read and User.Read.All. A global administrator grants those permissions for the tenant. Mailgestor then reads the user list and each mailbox through Microsoft Graph. Nothing is installed in the tenant, and no user needs to sign in.

Because the consent step alone does not prove who made it, Mailgestor immediately asks the same person to sign in to the tenant. Only when the sign-in names the same tenant as the consent is the organisation attached.

Steps

  1. Open Connections, choose New connection, then Microsoft 365 organisation. Or pick it in the guided setup.
  2. Microsoft opens the admin consent page. Sign in as a global administrator of the tenant to archive.
  3. Review the permissions and accept. They are all read-only.
  4. Microsoft returns you to Mailgestor, which sends you straight back to Microsoft for a sign-in restricted to that tenant. Sign in as the same administrator.
  5. Mailgestor checks that the permissions were granted and lists the users, then creates the connection.

If step 5 says the consent granted no application permissions, the permissions were accepted for a different tenant than the one you signed in to, usually because the browser was already signed in to another tenant. Sign out of Microsoft, or use a private window, and start again.

Choosing mailboxes

A job lists every user in the tenant. Tick the ones to archive. Users who have no mailbox, such as accounts without an Exchange licence, are dropped from the job automatically when it is measured. Microsoft reports each folder's item count, so the size shown is worked out from those counts.

Limiting which mailboxes Mailgestor can read

By default the application permission reaches every mailbox in the tenant. If your policy requires narrower access, either mechanism below works and Mailgestor needs no change:

  • An Exchange Online application access policy, which restricts the application to the members of a mail-enabled security group:
New-ApplicationAccessPolicy -AppId <Mailgestor's application id> -PolicyScopeGroupId <group> -AccessRight RestrictAccess
  • Microsoft Graph role-based access control for applications, in the Microsoft Entra admin centre, which does the same without PowerShell.

The application id is shown on the consent screen and in Enterprise applications after consent.

Removing access

In the Microsoft Entra admin centre, open Enterprise applications, find Mailgestor and delete it, or revoke its permissions. Connections that use it show Revoked at the next check. Remove the connection in the app to delete the stored credential.

Personal Microsoft accounts

Mailgestor does not offer a single Microsoft 365 or Outlook.com account connection. A single mailbox in a Microsoft 365 tenant is archived through the organisation connection by ticking just that mailbox.