What can an AI agent do with
Read, change, and delete email in every mailbox (Mail.ReadWrite, application)?
This is the company-wide version. It lets the app read, create, change, and delete email in every mailbox in your organization, with nobody signed in. It is not limited to your inbox or to what you can see.
How to spot it
On a Microsoft 365 (Microsoft Graph) connection or settings screen, this is Mail.ReadWrite. The consent screen words it as Read and write mail in all mailboxes
With it, an agent can
- Read email in every employee's mailbox
- Create, change, move, and delete email in any mailbox in the organization
- Keep working at any hour with nobody signed in
It cannot, on its own
- Send email (that needs Mail.Send)
- Be approved by a regular user; only a Global Administrator or Privileged Role Administrator can approve it
What a bad day looks like
If the app's own credentials are stolen or the agent is tricked, someone could read or delete email for your whole company at once, not just one inbox.
Set it up safer
- Use the delegated Mail.ReadWrite instead, which only reaches the mailbox of the person who signs in.
- If it must run with nobody signed in, have your admin grant access through RBAC for Applications in Exchange Online, limited to only the mailboxes it needs, instead of the company-wide grant.
- If it only reads, ask for read-only access. In this company-wide form Mail.Read still reaches every mailbox, so the mailbox limit above still matters.
Narrower permissions on Microsoft 365 (Microsoft Graph):
Ask the company selling the agent
- Why do you need every mailbox instead of just the one I connect?
- Can the agent work with access limited to specific mailboxes?
- Where do you store the app's credentials, and who at your company can use them?
Source
Checked against Microsoft 365 (Microsoft Graph) documentation on 2026-09-28. All Microsoft 365 (Microsoft Graph) permissions →
Thinking about a specific agent?
Tell us what it connects to, what it is allowed to do and who approves its work. You get a plain-language label of what it can touch and what to ask the seller. It takes a couple of minutes, and your answers stay in your browser unless you choose to post a test job.
Or have a person go through the AI apps on up to 3 of your business services with you and get a written report, for $249.
This page explains what a permission allows. It does not describe, test or rate any product. Permission details are summarized in our own words from the provider's documentation, linked on the page; providers change their documentation, so check the source before you rely on a detail.