User session

1. Click on ‘New Session’.

2. Click ‘Continue’.

3. Sign-in with your Microsoft 365 account credentials when prompted by Microsoft 365, and answer any 2-factor authentication set in your environment.

4. Give admin consent to the permissions needed by the sapio365 application.

5. If you’re a global admin, you’ll see this message about elevating your privileges. Click OK to close it.

Users

• View the entire user list for your tenant’s directory as well as all users’ profile information.

• Manage service plans and license information for all users. Set license units prices for cost analysis reports.

• Edit user profile information for any user, even multiple users at once.

• Create new users or import several from a file.

• Display and manage group memberships for every user in your tenant’s directory.

• For your own and others that you can access: one-to-one, group and meeting chats and chat messages.

Groups & Teams

• View all groups in your tenant, including their property information.

• Display and manage all group members and owners.

• See nested groups.

• See and manage Teams, their members, channels and files.

• Retrieve all file and folder information from document libraries.

• View groups' SharePoint site information.

• Add or remove owners for any group in your tenant, even multiple groups and owners at once.

• Manage mail delivery restrictions on any group in your tenant, even for multiple groups at once.

Mail

For your own mailbox and other mailboxes you have access to:

• View all email messages—including the mail folder structure.

• Preview messages directly from the full message list.

• See all message properties.

• Access all attachment information—and download or delete attachments directly.

• Manage mail rules for all mailboxes.

• Manage mailbox permissions.

Calendar events

For your own mailbox and other mailboxes you have access to:

• View and manage all calendar events.

• Preview calendar event body.

• Download or delete attachments.

Personal contacts

For your own mailbox and other mailboxes you have access to:

• See every users’ personal contacts.

OneDrive files and folders

For your own OneDrive and others you have access to:

• Manage all information—including permissions—for every OneDrive file and folder shared with you.

• Rename or delete files and folders.

• Download files and folders.

• Upload files and folders.

• Create folders.

SharePoint sites and lists

For SharePoint Online sites you have access to:

• Retrieve all SharePoint site information, including storage quotas.

• Show all lists—as well as their items and columns—for all your accessible sites at once.

• Manage all document library files and their permissions in one place.

• See personal sites and their content (elevated session).

Other

Depending on your rights:

• View usage reports.

• View sign-ins (requires Azure AD Premium P1 or P2 license) and admin audit logs.

• View and manage registered applications.

• View registered devices.

When launching a User session for the first time, the application requires a one-time admin consent for sapio365 to access Microsoft 365 data.

Upon creation, the sapio365 application “Ytria sapio365 - with Admin Consent” is added to the list of Enterprise Apps in your Azure Active Directory, which can then be used by the users who give user consent or by all users in the tenant if consent is given tenant-wide by an admin.

If the application is removed from Azure AD or the admin consent is revoked, it can be added back by creating an Advanced session once again.

Admins can limit access to sapio365 to specific groups or users using Conditional Access. See “I'm an admin. Can I limit usage to a specific group of users?” in FAQ below.

You’re consenting to the delegated permissions of the sapio365 application that allow you to access Microsoft 365 data within the scope of your user rights in Microsoft 365. This consent is between you and the sapio365 application. Your data NEVER goes through any third-party servers.

Only a global (company) administrator can provide admin consent for the permissions of sapio365 applications used in advanced and elevated sessions. If you can’t obtain admin consent, you can use a standard session.

No. Your access and actions remain limited by the rights and permissions you have in Microsoft 365. An advanced session in sapio365 gives you the advantage of having everything in one place, the ability to make bulk changes and create custom reports. You’ll need elevated privileges to access mailboxes and sites you don’t own.

No, sapio365 does not require external servers to process this information – ever.

Some data is stored locally on your machine as a cache to improve processing times. The encryption of data is session-based so your information is protected.

Yes, just like for any application in your Azure AD, you can enable “User assignment required?” (1), and assign users to the app (2).