What can an AI agent do with
Keep access while you are away (offline_access)?
It lets the app keep using the other permissions you approved even when you are not using it. It does not add any new powers on its own.
How to spot it
On a Microsoft 365 (Microsoft Graph) connection or settings screen, this is offline_access.
With it, an agent can
- Keep working with your email, files, or calendar while you are away, within the other permissions you approved
It cannot, on its own
- Do anything the other permissions do not already allow
What a bad day looks like
If you forget you connected the agent, it can keep acting on your account even when you are not around to watch.
Set it up safer
- Ask whether the agent can work only while you are signed in and using it, without offline_access.
- Remove the app's access as soon as you stop using it.
Ask the company selling the agent
- What does the agent do on my account when I am not using it?
- How do I fully disconnect it, and does that stop it right away?
Source
Checked against Microsoft 365 (Microsoft Graph) documentation on 2026-09-28. All Microsoft 365 (Microsoft Graph) permissions →
Thinking about a specific agent?
Tell us what it connects to, what it is allowed to do and who approves its work. You get a plain-language label of what it can touch and what to ask the seller. It takes a couple of minutes, and your answers stay in your browser unless you choose to post a test job.
Or have a person go through the AI apps on up to 3 of your business services with you and get a written report, for $249.
This page explains what a permission allows. It does not describe, test or rate any product. Permission details are summarized in our own words from the provider's documentation, linked on the page; providers change their documentation, so check the source before you rely on a detail.