How the Microsoft 365 connection works
Last updated: October 20, 2026
TrueNorth reviews how your Microsoft 365 files are shared and who can see them. To do that, your organization gives our app read-only permission through Microsoft's standard admin approval. Here is exactly what that involves.
1. Your administrator approves a read-only app on Microsoft's own page
- Your Microsoft 365 administrator (a Global Administrator) opens our connect link, confirms they are authorized, and is sent to Microsoft's own sign-in page at
login.microsoftonline.com. - Microsoft shows the app name and the exact permissions requested. Nothing happens unless your administrator clicks Accept.
- We never ask for, see or store anyone's password. No software is installed on your computers or servers.
2. The four read-only permissions, in plain words
| Permission | What it lets the app do | What we use it for |
|---|---|---|
Sites.Read.All | Read the list of SharePoint sites, libraries and items, and their sharing settings | File and folder names, paths, sharing links and who has access |
Directory.Read.All | Read your organization's directory | Organization name, licenses, users and guests, and admin roles |
AuditLog.Read.All | Read sign-in activity and audit records | Last sign-in dates for guests, and the record of who approved our app |
SharePointTenantSettings.Read.All | Read your SharePoint settings | Your organization-wide external sharing settings |
All four are read-only. The app has no permission to create, change, move, share or delete anything.
3. What we read, and what we never do
We read: site, library, folder and file names and paths; sharing links and their type, scope and expiry; permissions (who has access); users and guests; guest sign-in activity; admin roles; and organization-wide sharing settings.
We never: open, read or download the contents of your files, emails, chats or calendars; change any setting, file or permission; or send anything from your account. The app only reads information. It does not request permission to change anything.
4. You stay in control and can remove access at any time
To remove access, sign in to the Microsoft Entra admin center, go to Enterprise applications, open TrueNorth Exposure Scan, choose Properties, and select Delete. Once it is deleted, the app can no longer read anything in your Microsoft 365. You don't need to contact us first.
5. How long we keep the results
Review results are kept for 90 days by default, and a daily process deletes them once they reach that age. When a subscription ends, or when you ask, we delete them sooner. See our Privacy Policy and Security overview for details.
Questions before connecting? Email hello@truenorthdatashield.com.