Data sourced from Dakota Marketplace, the global LP and GP intelligence platform trusted by thousands of investment professionals. Learn More | Book a Demo
Connecting a tool to your work email raises three fair questions: what can it see, what does it keep, and what can it do in your name. Most people approving that request never get a clear answer to any of them. The vendor's security page says "encrypted" and "enterprise-grade," which tells you nothing about what the tool can actually reach.
Clear answers exist, and you do not need to be technical to ask for them.
In this article, we'll cover the difference that accounts for most of the risk, what send-only really means, the questions worth putting to any vendor, and how your firm can check and switch off access at any time.
Delegated vs. Application Permissions
There are two ways a tool can connect to Outlook, and the difference matters more than anything in the vendor's pitch.
One user at a time. You connect your own account, the tool acts as you, and it reaches only what you could reach yourself. Nobody else's mailbox is involved unless they connect too. Switching it off for one person affects one person.
The whole company at once. Access is granted to the software itself, across the organization, without anyone individually signing in. Some tools genuinely need this. Others ask because it was simpler to build.
The first kind is bounded by design. The second is a much larger commitment, and the fair question to a vendor asking for it is which feature requires it.
What “Send-Only” Actually Means
This is the single most useful thing to understand, because it separates a tool that can write email from a tool that can read yours.
Microsoft treats sending and reading as two separate permissions. A tool granted permission to send can write a message and send it as you. That permission gives it no way to open your inbox, search it, or pull anything out of it. It cannot see a single email you have already received.
Reading is a different permission, requested separately and shown separately when you approve the connection. A tool that only sends never receives it.
That makes "send-only" a checkable claim rather than a marketing line. Your IT team can look at the exact list of what was granted and confirm that your mail, calendar, contacts, and files are not on it. If the marketing says one thing and the list says another, the list is what counts.
Reviewing a tool that wants access to your inbox? Book a demo of Dakota Marketplace to see our Outlook Integration.
Questions to Ask Any Vendor
Four questions, and the answers should come back quickly and in writing.
-
Exactly what access are you asking for? Ask for the actual list, not a description of it. One user at a time, or the whole company.
-
What do you keep, and for how long? There is a real difference between storing the emails you send from the tool and storing what is already in your mailbox. Ask about passwords separately: a well-built integration never receives yours, because you sign in on Microsoft's own page.
-
How do we turn it off? The answer should not involve calling the vendor. If switching off access requires a support ticket, that is worth knowing before you sign.
-
Does any of this touch AI? Training, analysis, and sharing with outside partners are three different things. Ask about each, and ask who else in their supply chain can see your data.
A vendor who cannot answer these in a day has either not thought about it or would rather you did not ask.
How to Audit and Revoke Access Anytime
None of this depends on the vendor's cooperation.
Your Microsoft administrator can open the admin center, find any connected application, and see the exact list of what it was granted. That list is the truth, whatever a sales deck claimed.
From the same place they can switch it off: for the whole firm at once, or for a single person. They can also decide up front which people are allowed to connect at all.
Turning it off takes effect immediately. A well-built tool will show the user a prompt to reconnect rather than failing quietly, so nobody is left wondering why their email stopped sending.
How Dakota Handles This
Dakota's Email via Outlook integration is a working example of the above.
It connects one user at a time, and it is send-only. Dakota has no ability to read your existing mail, calendar, contacts, attachments, or files. Your messages go out through your own mailbox and land in your Sent Items, which keeps them inside your firm's retention and compliance policies. Dakota never receives your Microsoft password, and no AI or machine learning touches any of it.
Your administrator can switch it off at any time, for one person or for everyone, without asking us.
Book a demo to see how it's built.
