Amazon Quick Microsoft 365 Permissions by App
On this page
Answer first
Amazon Quick’s Microsoft 365 extensions do not share one permission contract. Word, Excel, and PowerPoint use the Office add-in ReadWriteDocument permission and do not require Microsoft Graph during deployment. Outlook uses ReadWriteMailbox; its full mailbox and calendar surface additionally requests broad delegated Microsoft Graph scopes.
Review the exact manifest and tenant consent screen. A generative action inside the current document and a Graph-authorized action across a mailbox or calendar have different blast radii.
Permission comparison
| App | Office permission | Graph during deployment | Documented action boundary |
|---|---|---|---|
| Word | ReadWriteDocument | None | Read and change the current document; create and redline content |
| Excel | ReadWriteDocument | None | Read and change the workbook; execute generated code in the Excel sandbox |
| PowerPoint | ReadWriteDocument | None | Read and change the deck; generate and edit slides and visuals |
| Outlook | ReadWriteMailbox | Required for full capability | Open-thread answers and drafts in bounded mode; broader mail, calendar, contact, file, task, and settings actions with consent |
All four add-ins can access profile information and send data over the Internet according to their documented capabilities. Verify Quick knowledge-base and connected-app permissions separately; the Office manifest does not describe every downstream data source.
Outlook Graph scope groups
AWS currently lists delegated scopes covering:
- calendar read and write, shared-calendar reads, and free/busy;
- mail content, metadata, drafts, attachments, organization, and deletion;
- contacts and people lookup;
- OneDrive or SharePoint file reads for attachments;
- mailbox settings, tasks, user identity, basic directory profiles, and
offline_access.
Tenant-wide consent grants this surface on behalf of assigned users. Review specific groups, Conditional Access, sign-in logs, revocation, incident response, and whether the bounded open-thread mode is enough.
Human confirmation is necessary, not sufficient
AWS says Outlook does not automatically send email or create calendar appointments; a human-in-the-loop confirmation appears first. The reviewer should verify:
- To, CC, BCC, external domains, and attendee list.
- Subject, body, claims, tone, date, timezone, recurrence, and location.
- Attachments, linked files, and their sharing permissions.
- Whether connected Quick data is current and allowed for every recipient.
- Duplicate-send, calendar-conflict, offline, timeout, and retry behavior.
A confirmation click does not repair a stale CRM fact, excessive Graph scope, wrong attachment, or unauthorized disclosure.
Application-specific acceptance
- Word: compare before/after text, references, track changes, comments, styles, and protected sections.
- Excel: verify formulas, ranges, data types, hidden cells, filters, totals, charts, and workbook recovery.
- PowerPoint: verify source numbers, slide master, layouts, overflow, notes, accessibility, and export.
- Outlook: verify action intent, recipients, mail or calendar state, permission scope, and audit evidence.
Start with the setup guide and use the deployment readiness checker before tenant-wide assignment.
Frequently asked questions
Do Amazon Quick Word, Excel, and PowerPoint require Microsoft Graph permissions?
AWS documents ReadWriteDocument and says no Graph permissions are needed during deployment for those three add-ins.
What permissions does the Amazon Quick Outlook extension use?
The add-in uses ReadWriteMailbox. Full capabilities additionally use delegated Graph scopes for mail, calendars, contacts, files, settings, people, tasks, identity, and offline access.
Can Amazon Quick send an email without review?
AWS says Outlook requires human confirmation before sending or creating appointments. Review all recipients, content, attachments, dates, and sources anyway.
Official sources
- AWS Outlook extension permissions
- AWS Excel extension permissions
- AWS Word extension permissions
- AWS PowerPoint extension permissions
Source check: August 20, 2026. Recheck manifest and Graph scopes, tenant consent, assignment, app capabilities, confirmation behavior, client support, and documentation status.