> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enterprise.emailmeter.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions on Microsoft 365

> Understand the scopes that Email Meter needs to work

<img style={{ borderRadius: '0.5rem' }} src="https://storage.googleapis.com/em-docs/enterprise-documentation/images/permissions-microsoft.webp" />

In order to ingest email to generate email statistics, Email Meter connects to your mailboxes using the Microsoft Graph API.

This page lists the permissions that Email Meter requires and provides information on what each permission is used for.

| Permission      | Display String                | Description                                                                                                           | Used for                                                                                                                             |
| --------------- | ----------------------------- | --------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| Mail.Read       | Read mail in all mailboxes    | Allows the app to read mail in the mailboxes that Email Meter is granted access to, without a signed-in user.         | Reading email headers in user’s mailboxes to generate email statistics.                                                              |
| User.Read.All   | Read all users' full profiles | Allows the app to read the full set of profile properties, reports, and managers of other users in your organization. | Getting the full name and profile picture of users.                                                                                  |
| Domain.Read.All | Read-only                     | Allows the app to read the domain list.                                                                               | Setting the default domains that are considered as internal on the email metric calculations. This can be manually customized later. |

<AccordionGroup>
  <Accordion title="Does Email Meter have access to the body of emails?">
    Although `Mail.Read` gives the app permission to read the body of our emails, none of Email Meter’s systems read, process or store the body or attachments of emails. This scope is essential at the moment, but we'll use a more restricted scope as soon as it's introduced by Microsoft. Please get in touch if you want more details about this.
  </Accordion>

  <Accordion title="Why don't you use Mail.ReadBasic.all?">
    We use `Mail.Read` to access Extended Properties, which are not available with the more limited `Mail.ReadBasic.all` scope. These properties are needed to:

    * Understand if an email is `Sent` or `Received`.
    * Identify which email another email is replying to.
    * Calculating response times.

    You can read more about Extended properties on Microsoft's documentation [here](https://learn.microsoft.com/en-us/graph/api/resources/extended-properties-overview?view=graph-rest-1.0).
  </Accordion>
</AccordionGroup>