Keep the documents inside the perimeter you already govern.
InflowSheet is the platform that runs the engagement. The Microsoft 365 integration is what lets that engagement operate without pulling your clients' documents out of the environment your firm already secures, retains, and audits.
Three things your IT lead will ask about.
Engagement files can live in your own sites and folder structure, so your retention policies, your permissions, and your eDiscovery all continue to apply — no second repository to govern.
Engagements work with the private Teams teams and channels your firm creates or links in your tenant, with membership managed against the identities you already control.
Your SSO, MFA, and Conditional Access policies gate access to InflowSheet. Offboarding a person in Entra offboards them here.
Every permission published, not described.
A tenant administrator approves each Microsoft Graph permission before anything connects, and can revoke consent at any time from the Entra admin center. Here is the full list — the same one in our Privacy Policy.
Used when the platform acts without a signed-in user.
Sites.SelectedOnly the SharePoint sites your admin explicitly grants — not the tenant.
Group.Read.AllRead group information to map teams and membership.
GroupMember.ReadWrite.AllRead and update the membership of Microsoft 365 groups, which hold Teams membership.
Directory.Read.AllRead directory data to identify users and structure.
User.Read.AllRead user profiles to map people to engagement roles.
Team.CreateAllows creating teams. It is part of the consent request, but InflowSheet does not create teams: engagements link to private teams your firm already has.
Team.ReadBasic.AllRead basic properties of Teams.
TeamMember.ReadWrite.AllAdd and remove Team members for collaboration.
Channel.CreateAllows creating channels in a team.
ChannelMember.ReadWrite.AllManage channel membership.
Used on behalf of a signed-in user, limited to what that user can already reach.
openidSign the user in.
profileRead basic profile of the signed-in user.
User.ReadRead the signed-in user’s profile.
Sites.FullControl.AllAct on SharePoint with the signed-in user’s own permissions.
Microsoft verified publisher. Your admin sees a verified identity on the consent screen rather than an unknown application.
What the integration does not mean.
We would rather be exact here than let a marketing phrase do work it cannot support in a security review.
InflowSheet processes and stores engagement data in its own Microsoft Azure environment in the US East region. That is what makes the workflow, the AI review, and the trial balance work possible.
Where the integration is used, documents that live in your SharePoint and Teams remain there, under your governance.
The full picture — storage, subprocessors, AI processing — is written out on the security page and in the Privacy Policy.