Inbox Cardinal

For IT administrators

What approving Inbox Cardinal actually grants.

A member of your organization asked to connect their own work mailbox. Your tenant requires admin approval for third-party applications, so Microsoft showed them the "needs admin approval" screen. This page tells you exactly what approval does, what it can never do, and how to revoke it.

What is being asked of you

Approving Inbox Cardinal for your tenant does not grant the application access to any mailbox. It only allows individual users to then grant access to their own mailbox, one at a time, through Microsoft's standard consent flow. Inbox Cardinal is a personal email-priority assistant: it ranks what matters across the mailboxes a person connects, read-only.

The application

  • Application name: Inbox Cardinal
  • Application (client) ID: d1f09ba9-4bbc-4455-ad71-56c0b56d8859
  • Publisher: EDG.tech, a Microsoft verified publisher (MPN 6894685)
  • Redirect URI: https://app.inboxcardinal.com/api/connect/microsoft/callback
  • Policies: Privacy and Terms
  • Security contact: security.txt

Exactly what access it requests

Delegated permissions only. The application has no application permissions and cannot act without a signed-in user's own consent:

  • Mail.Read: read the consenting user's mail, read-only
  • Calendars.Read: read the consenting user's calendar, read-only
  • User.Read: the consenting user's basic profile
  • offline_access, openid, email, profile: standard sign-in and token-refresh scopes

What it can never do

  • Cannot send, delete, move, or modify mail or calendar items. No write scope of any kind is requested.
  • Cannot see any other mailbox in your tenant. Delegated-only means each user consents individually to their own mailbox. There is no org-wide or application-level access, and our own policy forbids requesting it.
  • Cannot retain data after disconnect. Removing an account purges its synced data. Disconnect-means-delete is an architectural commitment, stated publicly on our Trust page.

Data handling

  • Message metadata and content excerpts are processed to compute priority scores for the mailbox owner. That is the entire use.
  • Never used to train AI models. Never sold or shared.
  • Encrypted in transit and at rest with customer-managed KMS keys. OAuth tokens are envelope-encrypted and never stored or logged in plaintext.
  • Hosted on AWS (us-east-1). No third-party email aggregator sits between Microsoft and the application; it talks to Microsoft Graph directly.
  • A formal SOC 2 audit is planned post-launch. We state that honestly rather than claiming it early. Security documentation is available on request: hello@inboxcardinal.com.

How to approve

The user's request generates a standard Microsoft admin-consent link of the form:

https://login.microsoftonline.com/{your-tenant-id}/adminconsent
  ?client_id=d1f09ba9-4bbc-4455-ad71-56c0b56d8859&...

Opening it as a Global Administrator (or a role with consent rights) shows Microsoft's own consent screen listing exactly the scopes above. Approval can be reviewed or revoked at any time in Entra admin center → Enterprise applications → Inbox Cardinal, where you can also audit which users have connected and remove access per-user or tenant-wide.

Revocation and audit

  • Tenant-wide: delete the enterprise application from Entra; all tokens die.
  • Per-user: revoke the user's grant in Entra, or the user disconnects in the product, which also purges their synced data.
  • All access is via Microsoft Graph with standard Entra sign-in logs, so every token issuance is visible in your audit tooling.

Questions before approving? Write to hello@inboxcardinal.com and we will answer directly.