BeZoned permissions in Enterprise mode – overview for IT reviewers

The Microsoft Graph permissions BeZoned uses in Enterprise mode, what each one is for, and what you revoke after installing.

This page is for IT and security teams reviewing BeZoned in Enterprise mode. It lists every Microsoft Graph permission BeZoned keeps, and what it uses each one for.

In short: BeZoned has no organization-wide write access. It can only change things in the Microsoft Teams teams where you install it, and when a signed-in user does something. All organization-wide permissions are read only.

Type	Count	Scope
Team-scoped (RSC)	9	Only the teams where BeZoned is installed
Delegated	9	Only when a signed-in user does something, and never more than that user can already do
Application	7	The whole organization, read only

Team-scoped permissions (RSC)

These only apply to the teams where your IT installs BeZoned. A team owner approves them when BeZoned is added to the team.

Permission	What BeZoned uses it for
`Channel.Create.Group`	Create a channel when a room is added to the office.
`Channel.Delete.Group`	Delete a channel when its room is deleted.
`ChannelSettings.ReadWrite.Group`	Show the office's channels, and update a channel's name or description when it's changed in BeZoned.
`ChannelMember.ReadWrite.Group`	Give office members access to private and shared channels. Not used yet: it will be used once BeZoned supports private and shared rooms.
`TeamMember.Read.Group`	Show who belongs to the office.
`TeamSettings.ReadWrite.Group`	Show the office's details, and update its name or description when it's renamed in BeZoned.
`TeamsTab.Create.Group`	Add BeZoned as a tab in the office's channels.
`TeamsTab.ReadWrite.Group`	Show channel tabs as shortcuts in BeZoned, and keep BeZoned tabs up to date.
`TeamsTab.Delete.Group`	Remove BeZoned tabs.

Delegated permissions

These are only used when a signed-in user does something in BeZoned.

Permission	What BeZoned uses it for
`openid`, `profile`, `email`	Sign in with the user's Microsoft 365 account.
`offline_access`	Keep the user signed in. It gives no extra access.
`Chat.Create`	Start a chat with a colleague from the office.
`Chat.ReadWrite`	Mark a chat as unread, so the colleague gets a notification.
`ChatMessage.Send`	Send a message to a colleague from the office.
`OnlineMeetings.ReadWrite`	Create a Teams meeting from BeZoned.
`Presence.ReadWrite`	Set the user's own status (available, busy, away).

BeZoned also has its own delegated permission, access_as_user, so users can sign in to the BeZoned app. It gives no access to Microsoft 365 data.

Application permissions (read only)

These apply to the whole organization and only allow reading.

Permission	What BeZoned uses it for
`Calendars.ReadBasic.All`	Show colleagues' free/busy times. BeZoned only sees times, not meeting content.
`MailboxSettings.Read`	Read settings such as the user's time zone. No access to email.
`OnlineMeetings.Read.All`	Know when a meeting started from BeZoned begins or ends.
`Organization.Read.All`	Read basic organization details, such as the company name.
`Presence.Read.All`	Show whether colleagues are available, busy or away.
`ProfilePhoto.Read.All`	Show colleagues' profile photos as avatars.
`User.Read.All`	Find colleagues by name or email, and check that they have a BeZoned license.

FAQ

How do we remove BeZoned's access to a team?

A team owner can remove BeZoned under Manage team > Apps. This ends BeZoned's team-scoped access to that team.

Does BeZoned send messages or change settings without our knowledge?

No. BeZoned only sends messages, creates meetings or changes channels when a user or administrator starts the action in BeZoned.

What data does BeZoned receive from Microsoft Teams?

BeZoned subscribes to a few change notifications to keep offices in sync. It does not receive audio, video, recordings, transcripts or message content. See FAQ – What data does BeZoned receive from Microsoft Teams change notifications? and our Data Processing Agreement.

Will we be told if BeZoned needs new permissions?

Yes. We notify customers at least 30 days before asking for new or broader permissions, and at least 90 days before a change that requires action from you, such as a new admin consent. Removing permissions needs no notice.

Was this helpful?

Still need help? Ask the team