Microsoft 365: Auth Integration, Data Handling and Access Revocation

Step-by-Step Guide | Client User Flow

This section explains the end-to-end process for configuring the Integration Engine to connect to your Microsoft 365 environment using OAuth integration. It outlines the user authorization flow, the permissions requested, how data is accessed and handled, and the steps to review or revoke access when required. The process is designed to ensure secure, read-only access aligned with security and compliance best practices.

Audience: End users connecting their Microsoft 365 accounts to COMPASS.

Purpose: Step-by-step guide for secure OAuth integration, data handling, and access revocation.

OAuth Connection Flow (Step-by-Step)

1. Start Connection

   • Go to → Integrations → Configurations.

   • Click Microsoft 365 (O365) under Original Equipment Manufacturers (OEMs) page.

   • Click Add Connection.

2. Redirect to Microsoft Login

   • You are sent to Microsoft’s secure login page.

3. Sign In

   • Enter your Microsoft 365 credentials (your password is never seen by the platform).

4. Review Permissions

   • Microsoft shows a list of permissions requested by PYOK. See list of permissions under Microsoft 365 Permissions section.

5. Consent & Authorize

   • Click Allow to grant access.

6. Redirect Back

   • You are redirected back to the COMPASS platform and see a confirmation message.

7. Connection Active

   • Your Microsoft 365 account now appears in Connected Services. 

What Data is Collected

Why This Data is Collected

• Access/Refresh Tokens: Enable secure, passwordless API access and background operations (e.g., key management, email encryption).

• User Email/ID: Associate the connection with your account for audit, support, and access control.

• Scopes: Limit platform to only the permissions you approve.

• Metadata: Ensure correct tenant and compliance context.

How Data is Secured

• Encryption at Rest: All tokens and sensitive data are encrypted using AES-256 in isolated, tenant-specific databases.

• Encryption in Transit: All communications use HTTPS/TLS 1.2+.

• Access Control: Only automated systems (not staff) can use your tokens for authorized operations.

• Audit Logging: Every access, refresh, and revocation is logged for compliance.

• Multi-Tenant Isolation: Your data is never mixed with other organizations.

How to Revoke Access

Option 1: From COMPASS

1. Go to Integrations → Configurations

2. Click Microsoft 365 (O365) under the Original Equipment Manufacturers (OEMs) page.

3. Under Actions column, click Delete.

Option 2: From Microsoft Account

1. Go to My Account

2. Find COMPASS Integrations app

3. Click Remove access.

What Happens After Revocation?

• COMPASS deletes all tokens and stops all access.

• Scheduled operations are cancelled.

• You can reconnect anytime.