harmon.ie App Consent and Required Permissions

This guide explains how and why harmon.ie uses Microsoft 365 app consent. You’ll learn what permissions are needed, when and how to grant consent as an administrator, and how to verify the setup. It also covers troubleshooting tips if users encounter consent-related issues. Whether you’re deploying New harmon.ie or harmon.ie Classic (365 Edition), this article will help ensure a secure and smooth configuration.
This article applies to both New harmon.ie and the harmon.ie 365 edition of harmon.ie Classic.

How to grant consent to harmon.ie

To authorize harmon.ie to access Microsoft 365 resources, a Microsoft 365 Global Administrator must complete the following steps:

  1. Select the appropriate consent link based on the version you are deploying:
    • New harmon.ie:

    • harmon.ie Classic v10.x or later: Click this consent link.
    • harmon.ie Classic v9.x:
      Click this consent link.
  2. Sign in using Global Administrator credentials.
  3. Review the requested permissions and click Accept.

For what each permission is used for, see What are the requested permissions and why are they required?

Why does harmon.ie require app consent?

OAuth 2.0 is the authentication method used by Microsoft to allow 3rd-party apps to access Microsoft 365 data.

The consent requirement in OAuth 2.0 for Microsoft 365 is a fundamental aspect of ensuring that users maintain control over their data, that their privacy is protected, and that security and compliance standards are upheld.

New harmon.ie and harmon.ie 365 use the OAuth 2.0 authentication to connect with Microsoft 365 on behalf of the app users, in order to view and work with Microsoft 365 files that the user is authorized to see. This ensures fully secure and compliant usage.

For harmon.ie to work, a Microsoft 365 admin should grant consent to harmon.ie. This is done once for all users.

  • Using harmon.ie, your emails and documents remain on your Microsoft tenant. The harmon.ie app connects directly to your Microsoft 365 tenant or SharePoint on-premises servicer. Data never leaves your tenant.
  • harmon.ie only asks for delegated permissions, and not for application permissions. The effective permissions are the least privileged intersection of the delegated permissions harmon.ie has been granted (through consent) and the privileges of the currently signed-in user. harmon.ie cannot have more privileges than the signed-in user. As a result, harmon.ie users can never access SharePoint content they are not authorized to view. For more information, read Permissions and consent in the Azure Active Directory v1.0 endpoint.

When is consent requested?

In New harmon.ie:

A Microsoft 365 admin should grant consent to all users at once, before deploying New harmon.ie.

If consent hasn’t been granted to all users, when a user launches the app for the first time, they will be asked to grant consent. Users can accept the permissions for themselves only if the company policy allows them to do so.

In harmon.ie Classic, 365 Edition:

During the download of harmon.ie Classic from the customer portal, you will be prompted to Accept the requested permissions. A Microsoft 365 admin can grant consent once for all harmon.ie users, by checking the Consent on behalf of your organization check box in the Requested permissions dialog. If the user that downloads harmon.ie isn’t a Microsoft 365 admin, they can accept the permissions only for themselves, if the company policy permits it.

A Microsoft 365 admin can later grant consent to all users at once by clicking the consent link.

What are the requested permissions and why are they required?

harmon.ie uses Microsoft Entra ID permissions and consent.

Here are the permissions New harmon.ie and harmon.ie Classic 10.x request, and why. Optional permissions turn on specific features: without them, harmon.ie works, but those features aren’t available.

Permission Why it’s needed New harmon.ie harmon.ie Classic 10.x
User.Read Allows users to share content with people in Teams using harmon.ie. Required Required
User.ReadBasic.All Allows users to share content with people in Teams using harmon.ie. Required Required
People.Read Allows users to share content with people in Teams using harmon.ie. Required Required
Files.ReadWrite.All Allows users to access their Microsoft 365 files from harmon.ie. Required Required
Mail.Read Allows users to save emails to Microsoft 365 with harmon.ie. Required Required
MailboxSettings.Read Reads user mailbox settings. Not required Required
Sites.ReadWrite.All Allows users to modify Microsoft 365 files using harmon.ie. Required Required
Team.ReadBasic.All Allows users to view their teams in harmon.ie. Required Required
Channel.ReadBasic.All Allows users to view their channels in harmon.ie. Required Required
ChannelMessage.Send Allows users to post messages in the channel chat. Required Required
Chat.Create Allows users to use harmon.ie to post messages in one-on-one or group chat. Required Required
Chat.ReadWrite Allows harmon.ie to display files that were shared in chats and meetings. Required Required
offline_access Allows users to access Microsoft 365 data when offline. Required Required
AllSites.Manage Allows users to discover and select the sites they want to view and access in harmon.ie. Required Required
Mail.ReadWrite.Shared Allows New harmon.ie to add categories to emails, save emails from shared mailboxes, start an email with attachments, and move or delete emails after saving them. Needed for email automation. Required Not required
MailboxSettings.ReadWrite Allows New harmon.ie to create master categories. Needed for email automation. Required Not required
Calendars.ReadWrite.Shared Allows New harmon.ie to create categories in shared mailboxes. (This permission is required due to current Microsoft Graph permission dependencies; no calendar data is read or modified.) Needed for email automation. Required Not required
Sites.Read.All Required for Copilot summaries. Optional Not required
People.Read.All Required for Copilot summaries. Optional Not required
OnlineMeetingTranscript.Read.All Required for Copilot summaries. Optional Not required
Chat.Read Required for Copilot summaries. Optional Not required
ChannelMessage.Read.All Required for Copilot summaries. Optional Not required
ExternalItem.Read.All Required for Copilot summaries. Optional Not required

How to verify that harmon.ie consent is properly configured?

To verify that harmon.ie’s requested permissions are properly configured:

  1. Open Microsoft Entra admin center (formerly Azure Active Directory).
  2. Navigate to Enterprise applications.
  3. Search for “harmon.ie”. Use the following Application (Client) IDs to identify the correct version:
    • 494b5977-84cb-4268-931b-f43aeca3e2e3 (New harmon.ie & harmon.ie Classic 10 or later)
    • 7442ddf4-dc0b-45b9-b34e-c12a12dd6db5 (harmon.ie Classic 9.x)
    • 10301466-86cc-4cb9-9007-a23f1a4c5ac8 (harmon.ie Classic 8.x-9.0)
  4. Select the relevant harmon.ie application.
  5. Go to Permissions.
  6. Verify that all required permissions show a status of Granted.

What to do if harmon.ie Classic download failed?

Your administrator might have disabled the option to authorize third-party apps to access Microsoft 365. In this case, you may fail to download harmon.ie Classic. Ask your Microsoft 365 administrator to manually grant consent then re-download the package.