Enterprise agents often need access to not just a single user’s data but an entire organization’s data for a specific resource. Previously every user was required to login and click through consent OAuth popups. When a single user denies access, permissions and gaps in data becomes a headache. Onboarding cost scales with number of end customers.
Alternatives might include running a legacy workaround like Exchange Web Services (EWS) impersonation, which gives a service account all access permissions to act as any user in an organization. With limited security control, enterprise agents still on EWS may have no guardrails inside the mailboxes they reach and can risk exposing sensitive data.
Ampersand now supports Microsoft (Admin consent), where one tenant administrator grants consent once for the whole organization. Your integration then calls the Microsoft Graph API as an application, with no individual user signing in. With Admin consent, scopes are granular and require approval for specific permissions.
What the connector supports
- Read actions: including full historic backfill and incremental read.
- Write actions: create and update records through Graph.
- Proxy actions: call any Graph endpoint yourself, using the base URL
https://graph.microsoft.com.
Because consent is granted at the tenant level, the object surface is Graph itself: users, groups, calendars, events, messages and many more.
Pick the right Microsoft connector
Both connectors stay available, and they answer different questions about whose data you are reading.
- Microsoft (Admin consent): org-wide, app-level access to the whole tenant.
- Microsoft: access scoped to an individual signed-in user.
