Account isolation
Every query in the application is scoped to your account. One account can never read another’s conversations, users, tags or reports.
Setup and security
Connected to Microsoft 365. Not bolted onto it.
No forwarding rules, no redirect to a foreign address, no “please create a new mailbox for the tool”. Your IT team grants consent once, you pick which shared mailboxes to connect, and mail flows both ways through the same addresses your customers already use.
Connect a mailbox in minutes.
Team Mail Manager talks to Microsoft 365 through the Graph API with application permissions, granted by a single tenant-wide admin consent. After that, connecting a shared mailbox is picking it from a list.
- One admin-consent step, performed by your Microsoft 365 administrator
- Pick the shared mailboxes to connect. Nothing else is touched
- New mail arrives in near real time via Microsoft change notifications
- A periodic catch-up sync backfills anything a missed notification would otherwise drop
- Subscriptions renew themselves; connections can be re-subscribed or re-synced on demand
- Outbound mail is sent by Microsoft as the mailbox. Your SPF, DKIM and DMARC set-up is unchanged
Sign in the way your company already does.
Sign in with Microsoft (Entra ID) so people use the account they already have, with whatever conditional access and MFA policy you enforce, or use an email and password if you’d rather not federate.
- Single sign-on with Microsoft Entra ID
- Email and password sign-in, with self-serve password reset
- A second step on top of a password: an authenticator app, or a passkey (a security key, a phone, Windows Hello, Touch ID)
- Passkeys sign in on their own, and only work on your own address, so they can’t be phished
- Invite teammates by email; invitation links expire and stop working once accepted
- Reset links are single-use. Setting a password invalidates the link that issued it
- Admins can view the app as another user to reproduce a problem, without knowing their password
Kept separate, kept only as long as you want it.
Access by membership
People see the inboxes they belong to, plus threads explicitly shared with those inboxes. Admins see the whole account; nobody sees beyond it.
Retention you choose
Per-inbox retention from six months to seven years, or keep everything. Expired threads are binned, then permanently deleted 30 days later.
Deletion that means it
A permanent delete removes the conversation, its attachments in object storage, and its search index entries, not just the row in a list.
An audit trail on every thread
Assignments, tag changes, status changes, transfers and shares are recorded with the person responsible and the time.
Dedicated deployments
Where a shared platform isn’t appropriate, Team Mail Manager can run as a dedicated single-tenant instance. Talk to us about what your policy requires.
What we don’t do. We don’t ask you to redirect mail to an address your customers have never seen, we don’t rewrite your sending domain, and we don’t need a mailbox of our own inside your tenant. The connection is read and send on the mailboxes you nominate, and you can revoke consent from Microsoft at any time.
A sensible order to do this in.
-
Consent and connect
Your Microsoft 365 admin grants consent once. Connect a single shared mailbox to start. You don’t have to move everything on day one.
-
Shape the inbox
Invite the team, appoint a manager, add the tags and rules you already use informally, and set the response times you’ve promised.
-
Widen it
Connect the next mailbox once the first team is happy. Reports start telling you something useful after a couple of weeks of real traffic.
Bring your IT team to the call.
We’ll walk through exactly which permissions are requested and why.