Outlook App Permissions (Mail.ReadWrite) Explained
When you connect an app to Outlook, the consent screen lists permissions with names like Mail.ReadWrite. They look cryptic, but each one maps to a specific, limited capability in the Microsoft Graph API. Here’s what the common ones mean so you can grant access with confidence.
Delegated vs application permissions
First, an important distinction:
- Delegated permissions act on your behalf, only while you’re signed in, and only on your mailbox. This is what consumer apps use.
- Application permissions let a service access mailboxes without a signed-in user (e.g. a server scanning many accounts). These require an admin to approve and are far broader.
Most tools you connect personally use delegated permissions — scoped to just your mailbox, revocable anytime.
The common mail permissions
| Permission | What it allows | Notes |
|---|---|---|
| User.Read | Read your basic profile (name, email, photo) | Minimal; used to show who’s signed in |
| Mail.Read | Read your email | Read-only |
| Mail.ReadWrite | Read and modify your email — move, delete, mark read, archive | Required for any cleanup tool |
| Mail.Send | Send email as you | Grant with care |
| offline_access | Refresh access while you’re away (background) | Enables long-lived/background access |
Why a cleanup tool needs Mail.ReadWrite
Deleting, archiving, or marking messages as read all change your mailbox, so read-only Mail.Read isn’t enough — moving a message to Deleted Items is a write. That’s why inbox cleaners request Mail.ReadWrite.
What Mail.ReadWrite does not grant:
- It can’t send email as you — that needs the separate
Mail.Send. - It can’t read anyone else’s mailbox — delegated access is limited to yours.
- It can’t change your password or account settings.
So the right thing to look for is least privilege: a cleanup app should ask for Mail.ReadWrite and User.Read, and nothing more.
How consent works
When you first connect, Microsoft shows a consent screen listing each permission in plain language. You approve on Microsoft’s page — the app never sees your password. Later you can review or revoke any app at myaccount.microsoft.com → Settings & Privacy → App permissions.
What Sender Sweep requests (and why)
Sender Sweep asks for exactly two delegated permissions:
- User.Read — to show your name and address after sign-in.
- Mail.ReadWrite — to move messages to Deleted Items, archive, mark as read, and read sender info for its analytics.
It deliberately does not request Mail.Send (it never emails as you) or application permissions (it only ever touches your mailbox, while you’re signed in). And because all processing happens in your browser, your mail is read directly from Microsoft Graph and never stored on Sender Sweep’s servers.
FAQ
Does Mail.ReadWrite let an app send email as me?
No. Sending requires the separate Mail.Send permission. Mail.ReadWrite only reads and modifies existing mail.
Why does a cleanup app need write access? Because deleting, moving, and archiving all change your mailbox. Read-only access can’t move a message to Deleted Items.
Can a delegated permission read other people’s mailboxes? No — delegated access is limited to the signed-in user’s own mailbox.
How do I revoke a permission later? Go to myaccount.microsoft.com → Settings & Privacy → App permissions and click Revoke. It’s instant and doesn’t affect your password.
Related: Is it safe to give an app access to your Outlook mailbox? and How to clean up your Outlook inbox.