Entra ID Setup

Grant admin consent once, designate the admins who manage your seats, and — if you want it — control who in your organization can take a seat.

Finding your Microsoft 365 Tenant ID

When you subscribe on the pricing page, Stripe checkout asks for your Microsoft 365 Tenant ID. This is what links your payment to your organization, so it has to be entered exactly.

1. Go to the Microsoft Entra admin center and sign in with a work account.
2. On the Overview page, find Tenant ID under Basic information.

   It's a 36-character value that looks like 77a5b88f-a3d1-4957-9b08-73d172054a46.

3. Click the copy icon next to it, then paste it into the Microsoft 365 Tenant ID field at checkout.

   Copy and paste rather than typing it out — a single wrong character means your payment can't be matched to your organization and access won't turn on.

How access works

Access to FileMy.Email is your subscription and its seats — not an Entra role. Once your subscription is active, anyone in your organization can open the add-in and start filing mail. They take one of your seats the first time they do, and seats are claimed first come, first served.

When every seat is taken, the next person to open the add-in is told so. An admin can free a seat at any time from the Admin tab inside the add-in, or add seats to the plan.

Two optional app roles are available in Microsoft Entra ID:

Step 1: Grant admin consent (one-time)

The add-in asks each user for the Microsoft Graph permissions it needs the first time they sign in. Consenting once on behalf of the organization means nobody sees those prompts. This step is optional but recommended.

1. Go to the Microsoft Entra admin center.

   Sign in with a Global Administrator account.

2. Navigate to Identity → Applications → Enterprise applications.

   FileMy.Email is a multi-tenant app, so it appears in your directory under Enterprise applications. There is no App registration for it on your side and nothing for you to register.

3. Search for "FileMy.Email" and click on the application.
4. In the left sidebar, click Security → Permissions.
5. Click Grant admin consent for [your organization] and review the list.

   Skipping this is fine — each user is simply prompted to consent for themselves the first time they sign in, and again the first time they turn on Auto-Archive.

What the add-in asks for, and why:

• Mail.Read, Mail.ReadWrite — read the message being filed, and tag it once it has been saved.
• Sites.Read.All, Files.ReadWrite.All — find your SharePoint sites and document libraries, and write the saved file.
• User.Read, User.ReadBasic.All — identify the signed-in user, and show display names on the admin seat list.
• MailboxSettings.ReadWrite, offline_access — required for Auto-Archive: read Out-of-Office state, and keep filing matching mail while a user is away.

These are delegated permissions — the add-in acts as the signed-in user and can only reach what that person can already reach. Sites.Read.All is additionally requested as an application permission, used only to list the sites in your tenant so the site picker shows all of them rather than just the ones a user happens to follow.

Restricting who can use FileMy.Email (optional)

By default anyone in your organization can open the add-in and take a seat. If you would rather decide who gets access, use Microsoft's own assignment requirement — Entra enforces it at sign-in, before a request ever reaches FileMy.Email.

1. In the Entra admin center, go to Identity → Applications → Enterprise applications.
2. Search for "FileMy.Email" and click on the application.
3. Open Properties, set Assignment required? to Yes, and click Save.
4. In the left sidebar, click Users and groups, then Add user/group.
5. Under Users, select the user or group who should have access.

   Assigning a security group covers everyone in it automatically. This is the easiest way to manage access at scale.

6. Under Select a role, choose FileMyEmail User.
7. Click Assign.

Anyone not on that list is now turned away by Entra at sign-in and never reaches the add-in.

Designating an admin

Assign the FileMyEmail Admin role the same way, choosing it under Select a role. Admins see an extra Admin tab in the add-in for subscription status, seat management, and removing users. A user can hold both roles — they will have admin access and consume a seat.

Common scenarios

Give everyone in my company access: Nothing to do. Once your subscription is active, everyone can use the add-in — just make sure you have bought at least as many seats as you have people who need it.

Make sure the right people get the seats: If you have fewer seats than staff, seats go to whoever opens the add-in first. To choose instead, follow Restricting who can use FileMy.Email and assign only the people who should have one.

Designate an admin: Assign the FileMyEmail Admin role to the person who should manage seats. They will see an "Admin" tab in the add-in where they can view subscription status, see who is using each seat, and remove users.

Remove a departed employee: An admin can remove a user's seat directly from the Admin tab in the add-in, with the option to purge their saved data. If you have turned on Assignment required, also remove their assignment in Entra so they cannot simply take the seat back.

Add more seats: Admins can click "Manage Subscription" in the Admin tab to go to the Stripe billing portal, where they can increase the seat quantity on your plan.

Need help?

Visit filemy.email, contact support, or manage your subscription.