Trust and security
What FlowInherit can reach in your Microsoft 365 tenant, what it keeps, and how you stay in control of it.
What FlowInherit can reach
A Global Administrator approves these permissions once for your organisation. You can see them any time under Enterprise applications in the Microsoft Entra admin centre.
| Permission | How it is used | Why |
|---|---|---|
| Directory.Read.All | Microsoft Graph, on behalf of the signed-in person | Read users, groups, apps and their owners for scans and the snapshot |
| Team.ReadBasic.All | Microsoft Graph, on behalf of the signed-in person | See which groups are Teams |
| Group.ReadWrite.All | Microsoft Graph, on behalf of the signed-in person | Hand group and Team ownership over. Microsoft still limits each change to what the person's own roles allow |
| User.Read, openid, profile, offline_access | Microsoft Graph, sign-in | Sign people in and keep them signed in |
| Exchange.ManageAsApp + Exchange Recipient Administrator | Exchange Online, as FlowInherit's app | Read and hand over distribution lists and mailbox access. Only offered to people who hold an Exchange role; never deletes anything |
No new powers
Scans, snapshots and group or Team handovers run with the signed-in person's own Microsoft token. If someone couldn't make a change in the Microsoft admin centres, they can't make it through FlowInherit either. Distribution list and mailbox changes go through Exchange as FlowInherit's app, so FlowInherit only offers them to people who hold Global, Exchange or Exchange Recipient Administrator.
FlowInherit never deletes a user, group, app, list or mailbox. It adds and removes owners and permissions, always adding the new owner and confirming it before removing the leaver.
Staying in control
- Pause: anyone signed in can stop every FlowInherit job in your tenant at once, including changes waiting to start. Only a Global Administrator can resume.
- Who can use it: turn on “Assignment required” on the FlowInherit enterprise app and assign only the people or groups you choose.
- Read-only access for security teams: the Auditor role can see every report and export the audit log, but can't start scans or change anything.
- Audit log: every sign-in, scan, report download, handover step, pause and billing change is recorded and can be exported as CSV.
- Removing FlowInherit: delete the FlowInherit enterprise app in Entra. Microsoft takes a few minutes to cut existing sessions off, so pause first.
What FlowInherit stores
To show reports and keep a history, FlowInherit stores:
- For people in your tenant: names, sign-in names and Microsoft object IDs, and whether accounts are enabled.
- For groups, Teams, apps, lists and mailboxes: names, addresses, IDs, owners, and who has Full Access or Send As.
- Licence names and counts.
- What each handover changed, and when, plus the audit log.
- For people who sign in to FlowInherit: their name, sign-in name and role, and an encrypted Microsoft sign-in token so jobs can finish after they close the page.
FlowInherit does not read email, files, chats or calendars.
How it is protected
- Hosted in Microsoft Azure data centres in the United States. All traffic uses TLS.
- Each customer's data is kept apart by row-level security in the database, tested on every code change.
- Saved Microsoft sign-in tokens are encrypted with AES-256-GCM.
- FlowInherit's own credentials are certificates kept in Azure Key Vault.
- Card payments are handled by Stripe. FlowInherit never sees card numbers.
Reporting a security issue
Email [email protected]. We will acknowledge your report within two business days.