What Management OS does with your Microsoft 365 data.

Management OS reads across the Microsoft 365 surface the leader has authorized:

• Outlook mail — message bodies, headers, threads, and folders. Used for buyer-signal extraction, inbound-reply surfacing on open deals, and board-thread tracking
• Calendar — events, attendees, descriptions, and meeting links across the user's primary and shared calendars
• OneDrive — personal files and shared-with-me files the user has access to. Used as context for AI-generated outputs via the File Source Picker
• SharePoint — document libraries on sites the user can already see. Same context-feeder role as OneDrive
• Account profile — display name, mail, and userPrincipalName for the connected-account UI

We do not read Teams chats, Teams meeting recordings, OneNote notebooks, Planner tasks, To-Do lists, Yammer, Viva, or any Microsoft 365 surface not explicitly listed in the scope table below.

We do not write to your Microsoft 365 data. Management OS holds no write scopes on Microsoft Graph. We cannot send mail on your behalf, create or modify calendar events, edit OneDrive files, upload to SharePoint, or change any Graph object.

All Management OS outputs (Account Plans, Coaching Briefs, Forecast Locks, Meeting Prep dossiers, Pitch Decks) are generated and stored inside Management OS's own database and surfaced through the Management OS application — never written back into your Microsoft 365 tenant.

The scope set is defined in lib/microsoft/oauth.ts → MICROSOFT_SCOPES. All scopes are delegated (user-context) Microsoft Graph scopes — never application-context. That means Management OS can only ever see what the signed-in user could already see themselves.

Application database: Supabase Postgres (Management OS's production database, US East). Encrypted at rest (AES-256), encrypted in transit (TLS 1.3). Workspace-scoped row-level security (RLS) means one customer's data is never visible to another.

OAuth tokens: Stored in the same Supabase database under workspace-scoped RLS. Microsoft rotates refresh tokens on every refresh; we persist the new value each time. Tokens are encrypted at rest and never returned to client browsers. Only the Management OS server-side runtime has access via service-role credentials.

Inference layer: Anthropic API (Claude models). Microsoft 365 data required for a specific brief or output is passed to Anthropic at inference time; outputs are returned to Management OS and stored in our database. Anthropic does not train on customer data per their API terms.

Retention: We retain Microsoft-sourced data while your subscription is active. On disconnect we delete OAuth tokens immediately and stop reading any new Microsoft data. On subscription cancellation, customer data is retained for 30 days for restoration, then permanently deleted. Data subject deletion requests are honored within 30 days per our Privacy Policy.

1. Sign up at mgmt-os.ai and complete onboarding to your workspace
2. Open Management OS → Settings → Integrations
3. Find Microsoft Outlook in the integration directory and click Connect Microsoft
4. You'll be redirected to the Microsoft sign-in screen, then the consent screen. Sign in with the Microsoft 365 account you want Management OS to read from
5. Review the requested permissions — Mail.Read, Calendars.Read, Files.Read.All, Sites.Read.All, plus identity scopes. Click Accept
6. You'll return to Management OS with a confirmation. The initial sync starts immediately and typically completes within a few minutes

Tenant admin notes: if your tenant has restricted user consent for third-party apps, your Microsoft 365 administrator may need to grant admin consent for Management OS once. After admin consent, individual users in the tenant can connect without further prompts. Until our Publisher Verification clears, external tenants will hit a consent block — contact support@mgmt-os.ai if you encounter that.

The Weekly Intelligence Brief is the primary surface. Three pillars synthesize your Microsoft 365 data:

• Develop Your Business — buyer-intent signals from inbound Outlook, champion behavior shifts across deal threads, calendar coverage on priority accounts, follow-up gaps after key meetings
• Develop Your Team — rep activity patterns surfaced from Outlook + Calendar, coaching context from upcoming meetings, 1:1 prep anchored on real events
• Develop Yourself — calendar audit (how time is actually spent vs. intended), leader focus, decision deadlines surfaced from threads you're sitting on

Ask Anything (AMA) — a conversational surface where you can query your Microsoft 365 data in plain English. Examples: "Who hasn't replied to me in the last 10 days on the Acme renewal thread?", "Pull the latest SOW from SharePoint and summarize commitments."

Universal File Source Picker: OneDrive and SharePoint feed the universal picker that selects context for AI-generated outputs — Account Plans, Pitch Decks, Coaching Briefs, Meeting Prep dossiers. Files you pick become context; files you don't, don't.

1. Open Management OS → Settings → Integrations
2. Find Microsoft in the connected integrations list
3. Click Disconnect → confirm

On disconnect we delete the stored OAuth tokens immediately and stop reading any new Microsoft data. Previously synthesized briefs and outputs remain in your Management OS workspace as historical records — they are not deleted automatically because they may contain decisions and context the leader still references.

To remove all historical briefs and Microsoft-sourced data after disconnect, email privacy@mgmt-os.ai with your workspace identifier. We process deletion requests within 30 days.

1. Sign in to account.microsoft.com (personal) or myaccount.microsoft.com (work or school) with the account that authorized Management OS
2. Open Privacy → Manage apps and services that can access your data (or, for work/school accounts: Settings & Privacy → Privacy → Apps and services)
3. Find Management OS in the list of permitted apps
4. Click into the entry and choose Remove these permissions (the exact label varies — "Edit", "Remove", or "Stop sharing" are equivalent)

Tenant-admin path: a Microsoft 365 global administrator can revoke admin consent for the whole tenant from Azure Portal → Enterprise applications → Management OS → Properties / Permissions / Revoke admin consent.

Revoking from Microsoft's side invalidates our tokens immediately. Our next Graph call returns a 401 and we surface a re-connection prompt in Management OS Settings.

Security incident reporting: security@mgmt-os.ai
Privacy / data subject requests: privacy@mgmt-os.ai
Integration support: support@mgmt-os.ai

For general questions about Management OS, see our Support page or Manifesto.