Skip to main content

For IT admins

Someone in your organization wants to use ContactGleaner, and your Microsoft 365 tenant requires admin approval for third-party apps. This page explains exactly what the app does and what access it needs, so you can make the call in a couple of minutes.

A gleaner securing the barn where the gathered contact cards are kept

What ContactGleaner does

ContactGleaner scans a user's own mailbox and calendar, uses AI to read email signatures, and turns the people they already correspond with into complete Outlook contacts. It reads the user's existing contacts so it recognizes people they already have and won't add anyone twice, and it reads the user's Outlook working-hours setting so scans run around their workday. Each user sees only their own mailbox, every contact is approved by the user before it's saved, and email content is never stored — only the extracted contact fields (name, title, company, phone) are kept.

What it can and cannot do

It can

  • ✓Read the signed-in user's own mailbox and calendar
  • ✓Read the signed-in user's existing Outlook contacts (to avoid duplicates)
  • ✓Save new contacts to Outlook — only after the user approves each one

It cannot

  • ✗Read another user's mail, calendar, or contacts
  • ✗Send email or modify or delete any messages or calendar events
  • ✗Store email content — only extracted contact fields are kept (name, title, company, phone)
  • ✗Access your tenant beyond what the signed-in user already has access to

Controlled and classified content

ContactGleaner is built to stay clear of Controlled Unclassified Information (CUI) and classified material. Any message carrying a controlled or classified marking is detected and dropped before any AI analysis and before anything is written to the database — it's never sent to the AI provider and no contact is ever saved from it. Only a metadata record of the block is kept; the message content is never stored. This protection is always on.

Markings are caught two ways: a marking typed into the message text (a CUI banner or classification header), and a Microsoft Purview sensitivity label. For labeled mail on organization accounts, the label is read from the message's metadata and the message is skipped before its body is ever fetched — so the controlled content never enters ContactGleaner's systems at all. Organization admins can see every blocked message, as metadata only, in their admin console.

To be candid about scope: this keeps controlled content out of ContactGleaner's AI pipeline and storage — ContactGleaner is not, and is not positioned as, an authorized CUI-handling enclave. If your organization uses custom Purview labels for CUI, reach out and we'll tune detection to them.

Permissions requested

All permissions are delegated — the app can only act as a signed-in user, never on its own and never across the tenant.

Mail.Read / Mail.ReadBasic

Reads email signature blocks to extract contact details. Message content is processed transiently and never stored.

Calendars.Read

Reads meeting attendee lists so attendees can be saved as contacts.

Contacts.ReadWrite

Reads the user's existing Outlook contacts so the app recognizes people they already have and never adds a duplicate, and saves user-approved new contacts to their address book.

MailboxSettings.Read

Reads the user's Outlook working-hours setting (working days, start and end times, and time zone) so scans run around their workday. Used only to schedule scans.

User.Read, openid, email, profile, offline_access

Standard sign-in: identifies the user and keeps them signed in between sessions.

Grant access for your organization

The button below takes you to Microsoft's standard admin-consent page, signed in as a Global Administrator of your tenant. One approval covers your whole organization — individual users won't see consent prompts afterward. You can review or revoke the grant at any time in the Microsoft Entra admin center under Enterprise applications → ContactGleaner.

Review & grant consent in Microsoft Entra

Questions before approving? Email support@contactgleaner.com — happy to walk through the data flow with you. ContactGleaner is a product of TMR Solutions LLC.