Skip to main content
The Draftable Clean Outlook add-in cleans attachments without any Microsoft permissions. One optional feature, the send-time check, needs an administrator to approve Draftable’s app, Draftable Clean, in Microsoft Entra ID. This article explains who needs to do this, what the app can access, and how to approve it. If you turn on support for files protected by Microsoft Purview, the desktop application also uses a separate app; see Protected files (Microsoft Purview). What the send-time check does: when a user presses Send in New Outlook for Windows or Outlook on the web, Draftable Clean reads the attachments as your mail server holds them and confirms they are the cleaned files, not the originals. It is a final safety net that stops an uncleaned document leaving if something went wrong earlier in the process.

​
Who needs to do this

You need to approve Draftable Clean if either of these applies to your organization:
  • You are deploying the add-in for the first time. Deploying the add-in does not approve Draftable Clean, so use the approval link after deploying.
  • Your organization approved the add-in’s permissions before Outlook add-in 1.12.114.0. From 1.12.114.0, the add-in connects to Microsoft 365 through Draftable’s production app, Draftable Clean, instead of the earlier app. Approval of the earlier app does not carry over, so an administrator needs to approve Draftable Clean once. You do not need to remove or redeploy the add-in.
Until Draftable Clean is approved, cleaning works as normal but the send-time check is off. See What happens if you do not approve it.
Users are never asked to approve anything themselves. The add-in does not show users a Microsoft permission prompt, so the send-time check stays off until an administrator approves the app for the whole organization.

​
About the Draftable Clean app

Use the application ID to confirm you are approving the right app, and to find it later under Enterprise applications.

​
What the app can access and why

The approval covers one Microsoft Graph permission and the standard sign-in permissions that come with it. All of them are delegated permissions: the add-in acts only as the signed-in user, and can only reach what that user can already reach in their own mailbox. Microsoft describes Mail.Read as reading the user’s mail because Microsoft offers no narrower permission that can read attachments. Draftable Clean uses it only to check the email being sent and to read your email size limit. It is read-only: the add-in never changes or sends mail through this permission. Cleaning still happens on the user’s own computer. Your documents are not sent to Draftable.

​
Who can approve it

According to Draftable’s approval result page, approving Draftable Clean for your organization requires a Global Administrator or a Privileged Role Administrator in Microsoft Entra ID. The approval applies to everyone in your organization. You only need to do it once.

​
How to approve it

Approve Draftable Clean with the approval link below. It does not change your deployment, so you can use it straight after deploying the add-in or at any time after users already have it.
1

Find your tenant

You need your organization’s Microsoft 365 tenant domain, for example contoso.onmicrosoft.com, or your tenant ID. The tenant ID is shown on the Overview page of Microsoft Entra ID in the Microsoft Entra admin center.
2

Prepare the link

Copy the link below and replace <tenant> with your tenant domain or tenant ID:
For example, for contoso.onmicrosoft.com the link starts https://login.microsoftonline.com/contoso.onmicrosoft.com/v2.0/adminconsent?....
3

Sign in and accept

Open the link in a browser and sign in with an administrator account that can approve apps. Microsoft lists the permissions Draftable Clean is asking for. Check that the app is Draftable Clean, then select Accept.
4

Check the result

Microsoft returns you to a Draftable page that reports the outcome. Consent granted means the approval worked, and nothing further is needed. Users do not need to sign in again.If the page says Consent was not granted or Consent was not completed, it shows the reason Microsoft gave. Cleaning keeps working in the meantime. You can try the same link again at any time.

​
How to check it worked

1
Open Outlook on the web or New Outlook for Windows and start a new email.
2
Add an attachment and let the Draftable Clean pane finish cleaning it, then close and reopen the pane.
3
Hover over the version line at the bottom of the pane. Graph ok means the add-in signed in to Microsoft 365 and read the email’s attachments successfully, so the send-time check is running.
If the line shows Graph off followed by a reason in brackets, the check is not running. Graph off (token) usually means Draftable Clean has not been approved yet. See Troubleshooting: Outlook Add-in for other causes. In Classic Outlook, once Draftable Clean is approved, the line shows Server check: not available in Classic. Before approval it shows Graph off (token), as in the other versions of Outlook. Server check: not available in Classic is expected: the send-time check is not used in Classic Outlook, because Classic Outlook saves drafts on the user’s computer and syncs them to the mail server with a delay. Use Outlook on the web or New Outlook for Windows to confirm the approval.

​
What happens if you do not approve it

The add-in keeps working without the approval:
  • Cleaning works as normal in every supported version of Outlook, and Send Protection still applies.
  • The send-time check is off. The version line at the bottom of the pane shows Graph off (token).
  • New Outlook for Windows and Outlook on the web users confirm each send that has cleaned attachments, with the message “Send-time verification isn’t enabled for this account, so Draftable Clean can’t confirm this email’s attachments before it’s sent.”
  • The add-in uses a standard default email size limit instead of your organization’s own limit.
  • Classic Outlook is not affected. It does not use the send-time check, so Classic users see no extra prompts.

​
Removing the approval

To withdraw the approval, open the Microsoft Entra admin center, go to Enterprise applications, find Draftable Clean (application ID a661f67c-f640-4e9c-8137-2ac9a32589d4) and remove its permissions, or delete the app from your tenant. Cleaning continues to work afterwards, and the add-in behaves as described in What happens if you do not approve it.

​
Protected files (Microsoft Purview)

This section is about the Draftable Clean desktop application, not the Outlook add-in. It applies only if you turn on support for files protected by Microsoft Purview, which is off by default. See Cleaning files protected by Microsoft Purview. To open a protected file, the desktop application signs the user in to Microsoft 365 through a different app from the one above. Draftable Clean also uses this app to open files from SharePoint and OneDrive.

​
What the app can access and why

Opening a protected file asks for one delegated permission. Draftable Clean acts only as the signed-in user, so it can open only files that user already has rights to. When a user approves the permission themselves, Microsoft asks them to allow Draftable Legal to Create and access protected content as you, Maintain access to data you have given it access to and View your basic profile. No SharePoint permissions are listed. When you approve for everyone in the Microsoft Entra admin center, Microsoft lists every permission on the app, SharePoint included.

​
Do you need to approve it?

Often not. Under Microsoft’s default consent settings, users can approve this permission themselves the first time they open a protected file. If your organization restricts user consent, users see “The organisation that protected this file hasn’t approved Draftable Clean for protected files yet.” Signing in again does not help; an administrator approves the app once for everyone. If your organization approved Draftable Legal earlier, for SharePoint, approve it once more so that the new permission is included. Whether users can actually open protected files is controlled by the Enable Microsoft Purview protected file support policy, not by the approval.

​
How to approve it

You need an administrator role that can grant admin consent, such as Cloud Application Administrator, Application Administrator or Global Administrator.
1

Open the app in Microsoft Entra

In the Microsoft Entra admin center, go to Enterprise applications > All applications and search for Draftable Legal or the application ID 6c0ba8ea-12a2-4cae-82e7-857cda5862e9. The app appears in your tenant after the first person signs in to it. If it is not there yet, use the link in the next step instead.
2

Grant admin consent

Open the app, then Security > Permissions, and select Grant admin consent for your organization. Sign in as an administrator, review the permissions Microsoft lists, and select Accept.Alternatively, replace <tenant> in this link with your tenant domain or tenant ID, open it, sign in as an administrator and select Accept:
Afterwards your browser may show an error page, such as one saying it can’t connect to localhost. That is expected: the approval is already recorded. If the address bar contains admin_consent=True, it worked.
3

Check the result

Refresh Security > Permissions and check that Azure Rights Management Services appears under Admin consent.
To confirm users are signing in, open Monitoring & health > Sign-in logs in Microsoft Entra ID and filter on the Draftable Legal application. The resource for protected-file sign-ins is Microsoft Rights Management Services. Check both the interactive and non-interactive sign-ins tabs.