Enabling ArcGlass for your Microsoft 365 tenant

A one-time setup that lets everyone in your organization sign in to ArcGlass with their work Microsoft account, and lets ArcGlass connect to the M365 mailboxes you choose to ingest from. Takes about 2 minutes. Requires a Microsoft Entra admin role (Global Administrator, Cloud Application Administrator, or Application Administrator).

What you're approving

ArcGlass uses one Microsoft Entra ID app registration for both single sign-on (SSO) and the M365 calendar/mail ingestion that powers our conversation analysis. When you approve, you're granting the app these Microsoft Graph permissions for your tenant:

The mail and calendar scopes are tenant-wide by Microsoft Graph's design, but ArcGlass only ever reads the mailboxes you explicitly add to a pipeline. SharePoint is tighter: it uses Sites.Selected, which grants no access on its own. ArcGlass needs SharePoint only for the opt-in file workflows — reading the recordings you share and writing the decks/briefs you request — and your admin grants access to individual sites, one at a time (see Connecting a SharePoint site below). We recommend a dedicated site per purpose (e.g. /sites/ArcGlassRecordings) so the grant covers just that content.

What ArcGlass will and won't do

• Read mailbox content only for the users you add to a pipeline in the ArcGlass UI.
• Read meeting transcripts and recordings created during the date range you configure.
• Read recordings only from a SharePoint site you grant ArcGlass read on, and write decks/briefs only to a site you grant write on.
• Never read mailboxes that aren't part of a configured pipeline.
• Never touch a SharePoint site you haven't explicitly granted — Sites.Selected denies every site by default.
• Never send mail on your behalf (the app does not request Mail.Send).
• Never modify or delete mail, calendar items, or contacts.
• Never share your data with any other ArcGlass customer.

You can revoke consent at any time from Entra ID → Enterprise applications → ArcGlass → Properties → Delete — which immediately stops all ingestion and SSO login for your tenant.

Step-by-step setup

1. Open the consent URL as a tenant admin

Copy this URL and open it in your browser:

The URL is self-serve — it'll mint a fresh single-use consent link and forward you straight to Microsoft's sign-in page. Sign in as a Global Administrator, Cloud Application Administrator, or Application Administrator for your Entra tenant, and complete any MFA prompts (the same MFA you use for the Microsoft admin center).

2. Review and approve

You'll see a Microsoft consent page titled "Permissions requested — Review for your organization" showing the permission list above. Read it, then click Accept.

3. Confirmation

Your browser will redirect back to a small green success page on api.arcglass.io that confirms your tenant has been approved. You can close the window. That's it — your whole organization can now use ArcGlass SSO.

What happens next

• For your users: anyone in your Entra tenant can now click "Sign in with Microsoft" on https://console.arcglass.io/login. On their first login, ArcGlass automatically creates your organization workspace and adds them as a member. Even brand-new users start from /login, not /signup.
• For mailbox ingestion: ingestion only starts after you (or another ArcGlass admin in your org) configure pipelines from inside the product, selecting which mailboxes and calendars to include. Approving SSO does not start any data flow on its own.

Connecting a SharePoint site (recordings & briefs)

If your team shares meeting recordings in SharePoint — or you want ArcGlass to deliver decks and briefs into SharePoint — grant ArcGlass access to just that one site. Because ArcGlass uses Sites.Selected, admin consent alone grants nothing; this step is what actually confers and limits access.

1. Grant ArcGlass access to the site

Run this once per site as a SharePoint or Global Administrator. It signs you in with only the privilege needed to create a site permission (that session only) and grants ArcGlass the single role you pass — read for a recordings site, write for a briefs destination:

Install-Module Microsoft.Graph.Authentication -Scope CurrentUser

./grant_arcglass_site_read.ps1 `
    -SiteUrl https://YOURTENANT.sharepoint.com/sites/ArcGlassRecordings `
    -ArcGlassAppId <your ArcGlass app id>

Your ArcGlass contact provides the script and your app id. Revoke any time with Remove-MgSitePermission — ArcGlass loses access immediately, with nothing to change on our side.

2. Tell ArcGlass which folder

Send the recordings folder URL — e.g. https://YOURTENANT.sharepoint.com/sites/ArcGlassRecordings/Shared Documents/Meetings — to your ArcGlass contact. ArcGlass resolves it to the site, library, and folder and begins picking up new recordings, read-only and app-only, in the background. (Self-serve configuration in the M365 integration settings is rolling out.)

Troubleshooting

Security and compliance

• Where the access lives: the consent records a service principal in your Entra tenant. You retain full visibility and revoke control via the Enterprise applications blade.
• SharePoint scope: access is per-site via Sites.Selected — ArcGlass can reach only the sites you explicitly grant, never your tenant at large. Revoke a single site with Remove-MgSitePermission without affecting the rest of the integration.
• What's stored on the ArcGlass side: only the tenant ID (a GUID) and the consent metadata — no user passwords or personal access tokens. Mailbox content read by pipelines is stored encrypted at rest in our managed Postgres on Render (US region), separated per customer-org at the row level.
• Subprocessor list, DPA, security questionnaire: available from your ArcGlass account team on request.

Questions

Reply to your ArcGlass account contact, or email support@arcglass.io.