> ## Documentation Index
> Fetch the complete documentation index at: https://help.owlery.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Approve Owlery for Your Organization

> How IT admins approve Owlery sign-in in Microsoft Entra ID or Google Workspace, and which permissions it requests.

If your organization requires admin approval for third-party apps, your team can't sign in to Owlery until you approve it. Approving takes a few minutes, and you only do it once.

## What Owlery Asks For

Owlery uses Microsoft or Google only to sign people in. It reads each user's name and email address, and nothing else. Every permission is delegated: it applies only to the person signing in. Owlery can't read anyone's mail, files, or calendar, and it never sees or stores passwords.

These are the only permissions Owlery requests. None of them are high-privilege. If your organization asks for admin approval for Owlery, it's because it requires it for every app, not because of anything Owlery requests.

| Provider | Permission | Scopes | What it allows |
| - | - | - | - |
| Microsoft | **Sign in and read user profile** | `openid`, `profile`, `email`, `User.Read` | Sign the user in and read their name, email, and organization name |
| Microsoft | **Maintain access to data you have given it access to** | `offline_access` | Keep the user signed in without logging in again. It adds no access. |
| Google | Basic profile and email | `userinfo.profile`, `userinfo.email` | Sign the user in and read their name and email |

## Microsoft Entra ID (Microsoft 365)

Use an admin account that can approve apps, such as **Global Administrator** or **Cloud Application Administrator**.

**1. Open the approval link**

[Approve Owlery in Microsoft Entra ID](https://login.microsoftonline.com/organizations/v2.0/adminconsent?client_id=9cf42718-adc2-47cd-8a8d-8cf742678669\&scope=openid%20profile%20email%20offline_access%20https%3A%2F%2Fgraph.microsoft.com%2FUser.Read\&redirect_uri=https%3A%2F%2Fowlery.ai%2Fapi%2Fauth%2Fcallback%2Fazure-ad), and sign in with your admin account.

**2. Review and accept**

Check that the app is **Owlery.ai**, published by **Owlery Inc** with Microsoft's verified publisher badge, and that the permissions match the table above. Click **Accept**.

Owlery is now approved for everyone in your organization, and no one else is asked to approve it.

If you'd rather work in the admin center, someone in your organization has to try signing in to Owlery first. Then go to `Microsoft Entra admin center → Enterprise applications → Owlery.ai → Permissions` and click **Grant admin consent**.

The app's client ID is `9cf42718-adc2-47cd-8a8d-8cf742678669`.

### Limit Access to Specific People (Optional)

By default, anyone in your organization can sign in once Owlery is approved. To allow only certain people or groups:

1. Go to `Microsoft Entra admin center → Enterprise applications → Owlery.ai → Properties`, set **Assignment required?** to **Yes**, and click **Save**.
2. Go to **Users and groups** and add the people or groups who should have access.

For details, see Microsoft's guide to [managing users and groups for an application](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/assign-user-or-group-access-portal).

## Google Workspace

Use a Google Workspace super admin account.

**1. Open API controls**

In the [Google Admin console](https://admin.google.com), go to `Security → Access and data control → API controls`, then click **Manage Third-Party App Access**.

**2. Find Owlery**

Click **Configure new app**, then search for Owlery's client ID:

```
360471429711-n2sacshcu2uu6928td51f1ni3q6ou24k.apps.googleusercontent.com
```

Select **Owlery** from the results.

**3. Choose who gets access**

Choose your whole organization, or limit access to specific organizational units or groups.

**4. Set access to Trusted**

Select **Trusted**. Owlery only requests basic sign-in information, so this doesn't give it access to any other Google data.

If a user was blocked and sent you an access request, you can approve it instead. See Google's guide to [reviewing third-party app access requests](https://knowledge.workspace.google.com/admin/apps/review-and-manage-third-party-app-access-requests).

## Security and Compliance

Owlery runs on enterprise-grade infrastructure with encryption at rest and in transit. It stores only each user's name, email address, and an internal ID. For security controls, subprocessors, and common questions, see the [Trust & Security Center](https://trust.owlery.ai/).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.