Custom Microsoft Graph Connectors with Scoped Permissions
A business wanted its AI tools to read from and write to Microsoft 365 data without handing them the keys to everything. NetSys built custom Microsoft Graph connectors with permissions scoped to exactly what each workflow needed.
Copilot and custom agents are only useful when they can reach the data a business runs on: mail, files, calendars, Teams and line-of-business records. The default way to get there is to grant broad application permissions, which means an AI tool can read far more than the task requires. The client wanted the capability without that exposure.
The requirement was specific. Connectors that could read the data a workflow needed and write back where the process called for it, nothing wider than that, with the permissions visible and reviewable by the people responsible for security.
The approach
Permission design first
Before any code, we mapped each workflow to the exact Graph scopes it needed, separating read from write and application access from delegated access. That map became the review document the client signed off on.
Build
Custom Graph connectors were built against the map, one per workflow, so a change to one process never widens the permissions of another.
Consent and review
Admin consent was granted per connector with its scope list attached, and the resulting permissions were reviewed in Entra ID so the security owner could see precisely what each connector can touch.
Handover
Documentation covers every scope, why it exists and how to revoke it, so the client can audit or retire a connector without calling us.
- Microsoft Graph API
- Microsoft Entra ID app registrations
- Scoped application and delegated permissions
- Microsoft 365
- Custom connector code
What changed
- AI workflows reach the Microsoft 365 data they need and nothing beyond it
- Every connector's permissions are documented and reviewable in Entra ID
- New workflows can be added without widening existing access
Client anonymized. This write-up is limited to the scope NetSys delivered; no outcome figures were measured for publication.
More case studies
Start with a free assessment — or the pen test.
Every engagement above began the same way: an honest look at where things stood. Take a scored assessment online, or book a free on-site penetration test and see your environment the way an attacker does.