FAQ - BeZoned Application Permissions

General understanding

Microsoft 365 applications use a permission-based security model. Before an application can access information or perform actions on behalf of a user or an organization, the required permissions must be granted by the user or a Microsoft 365 administrator.

BeZoned integrates deeply with Microsoft Teams and Microsoft 365 to create a unified virtual office experience. Rather than requiring users to switch between Teams, Outlook, Planner, Whiteboard, Files, and other Microsoft applications, BeZoned brings these capabilities together in a single interface.

To provide this experience, BeZoned uses the Microsoft Graph API — the standard Microsoft interface for accessing Microsoft 365 services. Every permission requested by BeZoned corresponds to a documented Microsoft Graph permission and is needed for one or more specific features in BeZoned.

BeZoned follows Microsoft's principle of least privilege: we only ask for the access our features need, and wherever possible we limit it to the teams where BeZoned is used or to actions you start yourself.

Last updated: 29 October 2026.

FAQ

How does BeZoned use my data?

BeZoned only uses data provided through the permissions listed below to deliver its online office functions. For example, it reads your presence so colleagues can see whether you are available, and it creates meetings only when you request one. The app does not access email contents, files or other data that are unrelated to online office operations. All data is processed in accordance with the BeZoned product privacy policy.

Does BeZoned send messages or change settings without my knowledge?

No. BeZoned only sends messages, creates channels or updates settings when you or an administrator start the action. For example, it might send a "Come join me in the kitchen" message when you click "Invite", or update a channel name when an admin renames a BeZoned room. The app cannot silently access email or impersonate users outside of Teams.

What is the offline_access scope and why do you need it?

offline_access lets BeZoned keep you signed in, so you aren't asked to sign in again every hour. It does not give BeZoned any extra access.

Can I remove some permissions?

BeZoned needs the permissions listed below to deliver the full online office experience. If a permission is removed, some features may stop working. If your organization has specific requirements, please contact BeZoned support and we'll help you find the right setup.

How do I grant these permissions?

A Microsoft 365 administrator in your organization reviews the permission list and approves it when BeZoned is installed. Once approved, BeZoned only uses the permissions for the features described in this article.

Will I be told if BeZoned needs new permissions?

Yes. BeZoned notifies customers at least three months before asking for new permissions.

Permissions needed

Permissions for the teams where BeZoned is installed

These permissions only apply to the Microsoft Teams teams connected to your BeZoned offices.

Name	Why BeZoned needs it
`Channel.Create.Group`	Create a new channel when a new room is added to your office.
`Channel.Delete.Group`	Delete a channel when the matching room is deleted from your office.
`ChannelSettings.ReadWrite.Group`	Show your office's channels, and update a channel's name or description when it's changed in BeZoned.
`ChannelMember.ReadWrite.Group`	Give office members access to private and shared channels. Not used yet: it will be used once BeZoned supports private and shared rooms.
`TeamMember.Read.Group`	Show who belongs to your office and what they're allowed to do.
`TeamSettings.ReadWrite.Group`	Show your office's details, and update its name or description when you rename it.
`TeamsTab.Create.Group`	Add BeZoned as a tab in your office's channels.
`TeamsTab.ReadWrite.Group`	Show your channel tabs as shortcuts in the Table Menu, and keep BeZoned tabs up to date.
`TeamsTab.Delete.Group`	Remove BeZoned tabs when a room or office is deleted.

Permissions used on your behalf

These permissions are only used when you do something in BeZoned, and only allow what you can already do yourself in Microsoft Teams.

Name	Why BeZoned needs it
`openid`, `profile`, `email`	Sign you in to BeZoned with your Microsoft 365 account.
`offline_access`	Keep you signed in (see FAQ).
`Chat.Create`	Start a chat with a colleague from the office.
`Chat.ReadWrite`	Mark a chat as unread so your colleague gets a notification.
`ChatMessage.Send`	Send a message to a colleague from the office.
`OnlineMeetings.ReadWrite`	Create a Teams meeting from BeZoned.
`Presence.ReadWrite`	Set your own status (available, busy, away) and status message from the office or Sidebar.
`TeamMember.ReadWriteNonOwnerRole.All`	Add colleagues to an office when you invite them.
`TeamSettings.ReadWrite.All`	Update the office's team in Microsoft Teams when you edit the office, for example its name or description.

Permissions for your organization

These permissions are approved by your administrator and let BeZoned keep the office up to date in the background.

Name	Why BeZoned needs it
`Calendars.ReadBasic.All`	Show colleagues' calendar availability in the avatar window. BeZoned only sees times, not the content of meetings.
`MailboxSettings.Read`	Read settings such as your time zone, to show the correct time. This does not give access to emails.
`OnlineMeetings.Read.All`	Know when a meeting started from BeZoned begins, ends or changes.
`Organization.Read.All`	Read basic information about your organization, such as the company name.
`Presence.Read.All`	Show whether colleagues are available, busy or away in the office and Sidebar.
`ProfilePhoto.Read.All`	Show colleagues' profile photos as avatars in the office.
`User.Read.All`	Find colleagues by name or email, show basic details such as their name, and check that they have a BeZoned license.
`Team.Create`	Create a new team in Microsoft Teams when you create a new office.
`Group.ReadWrite.All`	Delete the team when its office is deleted.
`TeamMember.ReadWrite.All`	Add and remove members of an office.
`TeamsAppInstallation.ReadWriteAndConsentSelfForTeam.All`	Add BeZoned to a new office's team, so the office is ready to use straight away.
`Chat.Create`	Start a chat between two colleagues from the office. Will be removed soon.
`Channel.Create`	Create a new channel when a room is added. Will be removed soon.
`Channel.Delete.All`	Delete a channel when a room is deleted. Will be removed soon.
`Channel.ReadBasic.All`	Keep room names up to date when a channel changes. Will be removed soon.
`ChannelSettings.ReadWrite.All`	Update channel names and descriptions. Will be removed soon.
`TeamSettings.ReadWrite.All`	Update the office's name or description in the background. Will be removed soon.
`TeamsTab.Read.All`	Show channel tabs as shortcuts in the Table Menu. Will be removed soon.
`Presence.ReadWrite.All`	Set colleagues' status from the office. Will be removed soon.

Permissions marked Will be removed soon are being replaced by the more limited permissions above. You don't need to do anything.

Was this helpful?

Still need help? Ask the team