Permissions Footer365 asks for, and why

Footer365 is set up with one or two approvals from a Global Administrator. Step 1 of the setup wizard grants the Footer365 app its permissions. Step 2, Choose how Footer365 adds signatures, decides whether a second is needed: with mail flow, step 3 gives the app the Exchange Administrator role, which is what lets it set up mail flow. With the Outlook add-in only, there is no step 3, so the app is not given an Exchange role. The wizard lists the permissions under What permissions is this? and If Microsoft does ask, what will it show?; this article adds the detail an IT administrator usually wants.

Step 1: Grant directory access

Selecting Continue to Microsoft opens Microsoft's admin consent screen. A single approval covers everything below, including the Exchange permission, so there is no separate Exchange consent screen.

Step 3: Grant the Exchange Administrator role

Only if you choose the Outlook add-in and mail flow in step 2. Footer365 holds no permission to change directory roles, so it cannot give itself this role. The assignment is made on your authority instead.

When you select Continue to Microsoft in step 3, Microsoft may ask you to approve once more. If it does, the screen shows:

You may also be taken straight through without a prompt. The approval stays on record against your account until you remove it in Enterprise applications in the Microsoft Entra admin centre.

If you would rather make the assignment yourself, expand Prefer to assign it yourself? in the wizard: in the Microsoft Entra admin centre go to Roles and administrators, select Exchange Administrator, then Add assignments, search for Footer365 and add it. The wizard carries on by itself once the role is detected. See Grant the Exchange Administrator role.

What the Exchange Administrator role is used for

The role is Microsoft's built-in Exchange Administrator role. Footer365 uses it for these tasks only:

• creating, checking, repairing, disabling and removing the two Footer365 connectors and two Footer365 transport rules;
• turning on event-based add-in activation and modern authentication if either is off, so the Outlook add-in can work;
• turning people's own Outlook signatures off or back on, when you choose to;
• reading and setting people's automatic replies, only once a Super Admin has turned on Out of office. Until then Footer365 never reads or changes an automatic reply. See Set automatic replies for your people.

The full list, with exact object names and settings, is in What Footer365 creates in Exchange Online. Every change is recorded in your audit log.

With the Outlook add-in only, Footer365 does none of this. If your organisation moves from mail flow to the Outlook add-in only, Footer365 uses the role to remove its connectors and rules and turn people's own Outlook signatures back on, and then no more. The role stays assigned, because Footer365 cannot change directory roles. A Global Administrator can remove it in the Microsoft Entra admin centre. Using the Outlook add-in only

The Outlook add-in

Deploying the add-in from Integrated apps in the Microsoft 365 admin centre shows Microsoft's own permission screen for it. The add-in asks for read and write access to the message being composed, which is what it needs to place the signature. It signs people in with the Footer365 app you approved in step 1, so no further admin consent is needed. See Deploy the Outlook add-in.

Optional: write-back to Entra ID

Staff self-service can write the details staff change to their Entra ID profiles, if you turn write-back on. That needs a permission no other part of Footer365 has, so it is held by a separate application, Footer365 Directory Write, which is used for nothing else and which you consent to only if you turn write-back on. It never appears on the step 1 consent screen.

Each write changes a single field of a single person, and is recorded in your audit log. A Global Administrator approves it from Continue to Microsoft on that card, and can take it away by deleting Footer365 Directory Write from Enterprise applications in the Microsoft Entra admin centre, which leaves the main Footer365 application as it is. See Let staff edit their own details.

What Footer365 cannot do

• It cannot change directory roles. The only role-write permission is the delegated one in step 3, used while you are signed in.
• It cannot change or delete anything in your directory through the Footer365 application, whose directory permissions are all read-only. The one exception is write-back to Entra ID, which you turn on yourself and which goes through Footer365 Directory Write, above. It writes profile details only, and never creates or deletes a user.
• It cannot delete its own app from your tenant. It holds no permission to manage applications, which is why removing Footer365 fully means deleting the enterprise application yourself. See Removing Footer365.
• It asks for no permission to read or send mail from your mailboxes. With mail flow, mail reaches Footer365 only because your own transport rule routes it there, and it is handed straight back. With the Outlook add-in only, no mail reaches Footer365 at all.
• It never sees a password. Everyone signs in through Microsoft Entra ID.

A Global Administrator can revoke everything at any time by deleting the Footer365 enterprise application in the Microsoft Entra admin centre.