Microsoft 365 permissions

Dytto works inside a user’s own Outlook mail and calendar. This page lists every Microsoft Graph permission it requests and what each one is for.

Application

Application name	`dytto.ai`
Application (client) ID	`8d7eb2d4-fa5c-4604-aa0c-ddb9673a02ec`
Publisher	Dytto BV, Belgium. Microsoft verified publisher.
Permission type	20 delegated
Hosted in	AWS eu-central-1 (Frankfurt)

Permission model

Microsoft Graph has two permission models. Application permissions let an app act as itself, with no user signed in. Delegated permissions let an app act on behalf of a signed in user, within that user’s own access rights.

All twenty permissions Dytto requests are delegated, shown as type Scope in Entra. Every Graph call carries the signed in user’s token, so Microsoft applies that user’s own access rights to it.

Tenant wide consent determines who answers the consent prompt. Without it, each user is prompted at first sign in. The permissions granted are the same either way.

Permissions

Second column is Microsoft’s wording, so you can match it against the consent screen.

Permission	Microsoft’s wording	What it is for
`openid`	Sign users in	Signs the user in. No data access.
`profile`	View users’ basic profile	Name and username in the sign in token.
`email`	View users’ email address	The user’s email address in the sign in token.
`User.Read`	Sign in and read user profile	Reads the signed in user’s own profile, including their mailbox address.
`offline_access`	Maintain access to data you have given it access to	Refresh token, so the user is not asked to sign in again each hour.
`Mail.ReadWrite`	Read and write access to user mail	Reads and searches the mailbox, and creates drafts in the user’s Drafts folder.
`Mail.Send`	Send mail as a user	Sends a message from the user’s mailbox. Dytto prepares the message and sends it when the user approves it.
`Mail.ReadWrite.Shared`	Read and write user and shared mail	Shared and delegate mailboxes, subject to Exchange delegation in your tenant.
`MailboxFolder.Read`	Read a user’s mailbox folders	Reads the mailbox folder structure.
`MailboxItem.Read`	Read a user’s mailbox items	Reads individual items in the mailbox.
`MailboxSettings.Read`	Read user mailbox settings	Reads settings such as archive folder, time zone and working hours.
`MailboxSettings.ReadWrite`	Read and write user mailbox settings	Updates those settings when the user asks.
`Calendars.ReadWrite`	Have full access to user calendars	Reads availability and creates or edits events in the user’s calendar.
`Calendars.Read.Shared`	Read user and shared calendars	Reads a colleague’s shared calendar.
`People.Read`	Read users’ relevant people lists	Recipient autocomplete, and resolving a colleague’s name to an address.
`Contacts.Read`	Read user contacts	Reads the user’s Outlook contacts.
`User.ReadBasic.All`	Read all users’ basic profiles	Resolves colleagues by name and address.
`Place.Read.All`	Read all company places	Reads meeting rooms, so a room can be offered when scheduling.
`Notes.ReadWrite`	Create, edit and delete OneNote notebooks	OneNote content the user asks Dytto to work with.
`Tasks.ReadWrite`	Create, read, update and delete user’s tasks	Microsoft To Do tasks.

Review and revoke

After consent, Dytto appears under Entra admin center > Enterprise applications. There you can review the permissions, restrict use to a security group (Properties > Assignment required, then Users and groups), apply Conditional Access, and revoke access.

Our data processing agreement, security annex and subprocessor list are available on request from support@dytto.ai.

Last updated 27 August 2026. Dytto BV, Belgium.