How Tally connects to your emails

Tally connects to Microsoft 365 to read and act on the emails your team handles — monitoring inboxes, drafting replies, and sending on behalf of connected users.

There are two integration models. Both use Microsoft Entra ID and Microsoft Graph. The difference is who owns the app and how mailbox access is scoped.

Connect your organization to the Tally 365 app

Best for: Teams that want the fastest setup with minimal IT work.

Tally provides a shared Microsoft 365 app. Your IT admin grants admin consent once, installing Tally into your Entra tenant.

After consent, an admin configures which mailboxes Tally monitors from Settings → Company → Email — picking individual users, distribution groups, or shared mailboxes directly in Tally.

Individual users can also connect their own mailbox from Settings → Profile (/settings/profile) for delegated access (e.g. sending as themselves). That step is per-user and uses OAuth sign-in.

How access works: Admin consent unlocks org-wide monitoring. Users you select in Company Email settings are monitored via Tally's app. Profile connections are optional and user-driven.

Connect your organization to the Tally 365 app

---

Connect via your organization's own MS Entra app

Best for: Organizations with strict security requirements who want full control over the integration app and precise, group-based access scoping.

Your organization creates and owns the Microsoft Entra app registration. You provide Tally with credentials for that app, and you control permissions, conditional access, and revocation entirely within your tenant.

The key difference is how mailboxes are scoped. As part of setup, your admin:

1. Creates a mail-enabled security group (e.g. TallyMonitored) containing only the mailboxes Tally should access
2. Configures Exchange RBAC for Applications so Tally's app can only reach members of that group
3. Registers the group in Tally at the end of the setup wizard

Tally then connects to those mailboxes using app-only authentication — no individual user needs to sign in at Profile for monitoring to work. Adding or removing a mailbox is done by updating group membership in Microsoft 365.

How access works: Mailbox access is defined by security group membership + Exchange RBAC, not by per-user OAuth. Profile connections may still be used in some cases (e.g. shared mailbox sends), but the primary model is org-level, group-scoped app access.

Connect via your organization's own MS Entra app