> ## Documentation Index > Fetch the complete documentation index at: https://help.draftable.com/llms.txt > Use this file to discover all available pages before exploring further. # Approving Draftable Clean in Microsoft Entra > How Microsoft 365 administrators approve the Draftable Clean app in Microsoft Entra ID so the Outlook add-in's send-time check can run, what the app can access, and how to confirm the approval worked. Also covers the desktop app's Rights Management permission for Microsoft Purview protected files. The Draftable Clean Outlook add-in cleans attachments without any Microsoft permissions. One optional feature, the **send-time check**, needs an administrator to approve Draftable's app, **Draftable Clean**, in Microsoft Entra ID. This article explains who needs to do this, what the app can access, and how to approve it. If you turn on support for files protected by Microsoft Purview, the desktop application also uses a separate app; see [Protected files (Microsoft Purview)](#protected-files-microsoft-purview). **What the send-time check does:** when a user presses **Send** in New Outlook for Windows or Outlook on the web, Draftable Clean reads the attachments as your mail server holds them and confirms they are the cleaned files, not the originals. It is a final safety net that stops an uncleaned document leaving if something went wrong earlier in the process. ## Who needs to do this You need to approve **Draftable Clean** if either of these applies to your organization: * **You are deploying the add-in for the first time.** Deploying the add-in does not approve **Draftable Clean**, so use the [approval link](#how-to-approve-it) after deploying. * **Your organization approved the add-in's permissions before Outlook add-in 1.12.114.0.** From 1.12.114.0, the add-in connects to Microsoft 365 through Draftable's production app, **Draftable Clean**, instead of the earlier app. Approval of the earlier app does not carry over, so an administrator needs to approve **Draftable Clean** once. You do not need to remove or redeploy the add-in. Until **Draftable Clean** is approved, cleaning works as normal but the send-time check is off. See [What happens if you do not approve it](#what-happens-if-you-do-not-approve-it). > [!NOTE] > > Users are never asked to approve anything themselves. The add-in does not show users a Microsoft permission prompt, so the send-time check stays off until an administrator approves the app for the whole organization. ## About the Draftable Clean app | Detail | Value | | - | - | | App name shown in Microsoft Entra ID | **Draftable Clean** | | Application (client) ID | `a661f67c-f640-4e9c-8137-2ac9a32589d4` | Use the application ID to confirm you are approving the right app, and to find it later under **Enterprise applications**. ## What the app can access and why The approval covers one Microsoft Graph permission and the standard sign-in permissions that come with it. All of them are **delegated** permissions: the add-in acts only as the signed-in user, and can only reach what that user can already reach in their own mailbox. | Permission | How Microsoft describes it | Why Draftable Clean needs it | | - | - | - | | `Mail.Read` | Read user mail | To read the attachments on the email being sent, so the send-time check can confirm they are the cleaned copies. It is also used to read your organization's email size limit | | `openid` | Sign users in | Standard sign-in permission | | `profile` | View users' basic profile | Standard sign-in permission | | `offline_access` | Maintain access to data you have given it access to | Lets the add-in keep working without asking users to sign in again | Microsoft describes `Mail.Read` as reading the user's mail because Microsoft offers no narrower permission that can read attachments. Draftable Clean uses it only to check the email being sent and to read your email size limit. It is read-only: the add-in never changes or sends mail through this permission. Cleaning still happens on the user's own computer. Your documents are not sent to Draftable. ## Who can approve it According to Draftable's approval result page, approving **Draftable Clean** for your organization requires a **Global Administrator** or a **Privileged Role Administrator** in Microsoft Entra ID. The approval applies to everyone in your organization. You only need to do it once. ## How to approve it Approve **Draftable Clean** with the approval link below. It does not change your deployment, so you can use it straight after deploying the add-in or at any time after users already have it. **1. Find your tenant** You need your organization's Microsoft 365 tenant domain, for example `contoso.onmicrosoft.com`, or your tenant ID. The tenant ID is shown on the **Overview** page of Microsoft Entra ID in the Microsoft Entra admin center. **2. Prepare the link** Copy the link below and replace `` with your tenant domain or tenant ID: ```text theme={null} https://login.microsoftonline.com//v2.0/adminconsent?client_id=a661f67c-f640-4e9c-8137-2ac9a32589d4&scope=openid%20profile%20offline_access%20https://graph.microsoft.com/Mail.Read&redirect_uri=https://dl.draftable.com/addins/metadata/latest/v1/consentRedirect.html ``` For example, for `contoso.onmicrosoft.com` the link starts `https://login.microsoftonline.com/contoso.onmicrosoft.com/v2.0/adminconsent?...`. **3. Sign in and accept** Open the link in a browser and sign in with an administrator account that can approve apps. Microsoft lists the permissions **Draftable Clean** is asking for. Check that the app is **Draftable Clean**, then select **Accept**. **4. Check the result** Microsoft returns you to a Draftable page that reports the outcome. **Consent granted** means the approval worked, and nothing further is needed. Users do not need to sign in again. If the page says **Consent was not granted** or **Consent was not completed**, it shows the reason Microsoft gave. Cleaning keeps working in the meantime. You can try the same link again at any time. ## How to check it worked **Step 1** Open **Outlook on the web** or **New Outlook for Windows** and start a new email. **Step 2** Add an attachment and let the Draftable Clean pane finish cleaning it, then close and reopen the pane. **Step 3** Hover over the version line at the bottom of the pane. **Graph ok** means the add-in signed in to Microsoft 365 and read the email's attachments successfully, so the send-time check is running. If the line shows **Graph off** followed by a reason in brackets, the check is not running. **Graph off (token)** usually means **Draftable Clean** has not been approved yet. See [Troubleshooting: Outlook Add-in](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Troubleshooting-Outlook-Add-in.md) for other causes. In **Classic Outlook**, once **Draftable Clean** is approved, the line shows **Server check: not available in Classic**. Before approval it shows **Graph off (token)**, as in the other versions of Outlook. **Server check: not available in Classic** is expected: the send-time check is not used in Classic Outlook, because Classic Outlook saves drafts on the user's computer and syncs them to the mail server with a delay. Use Outlook on the web or New Outlook for Windows to confirm the approval. ## What happens if you do not approve it The add-in keeps working without the approval: * **Cleaning works as normal** in every supported version of Outlook, and Send Protection still applies. * **The send-time check is off.** The version line at the bottom of the pane shows **Graph off (token)**. * **New Outlook for Windows and Outlook on the web users confirm each send** that has cleaned attachments, with the message "Send-time verification isn't enabled for this account, so Draftable Clean can't confirm this email's attachments before it's sent." * **The add-in uses a standard default email size limit** instead of your organization's own limit. * **Classic Outlook is not affected.** It does not use the send-time check, so Classic users see no extra prompts. ## Removing the approval To withdraw the approval, open the Microsoft Entra admin center, go to **Enterprise applications**, find **Draftable Clean** (application ID `a661f67c-f640-4e9c-8137-2ac9a32589d4`) and remove its permissions, or delete the app from your tenant. Cleaning continues to work afterwards, and the add-in behaves as described in [What happens if you do not approve it](#what-happens-if-you-do-not-approve-it). ## Protected files (Microsoft Purview) This section is about the Draftable Clean **desktop application**, not the Outlook add-in. It applies only if you turn on support for files protected by Microsoft Purview, which is off by default. See [Cleaning files protected by Microsoft Purview](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Cleaning-files-protected-by-Microsoft-Purview.md). To open a protected file, the desktop application signs the user in to Microsoft 365 through a different app from the one above. Draftable Clean also uses this app to open files from SharePoint and OneDrive. | Detail | Value | | - | - | | App name shown in Microsoft Entra ID | **Draftable Legal** (publisher Draftable, verified) | | Application (client) ID | `6c0ba8ea-12a2-4cae-82e7-857cda5862e9` | ### What the app can access and why Opening a protected file asks for one delegated permission. Draftable Clean acts only as the signed-in user, so it can open only files that user already has rights to. | Permission | How Microsoft describes it | Why Draftable Clean needs it | | - | - | - | | Azure Rights Management Services `user_impersonation` | Create and access protected content for users | To ask Microsoft's protection service to unlock a protected file for the signed-in user. The file is decrypted on the user's computer and is not sent to Draftable | When a user approves the permission themselves, Microsoft asks them to allow **Draftable Legal** to **Create and access protected content as you**, **Maintain access to data you have given it access to** and **View your basic profile**. No SharePoint permissions are listed. When you approve for everyone in the Microsoft Entra admin center, Microsoft lists every permission on the app, SharePoint included. ### Do you need to approve it? Often not. Under Microsoft's default consent settings, users can approve this permission themselves the first time they open a protected file. If your organization restricts user consent, users see **"The organisation that protected this file hasn't approved Draftable Clean for protected files yet."** Signing in again does not help; an administrator approves the app once for everyone. If your organization approved **Draftable Legal** earlier, for SharePoint, approve it once more so that the new permission is included. Whether users can actually open protected files is controlled by the **Enable Microsoft Purview protected file support** policy, not by the approval. ### How to approve it You need an administrator role that can grant admin consent, such as **Cloud Application Administrator**, **Application Administrator** or **Global Administrator**. **1. Open the app in Microsoft Entra** In the Microsoft Entra admin center, go to **Enterprise applications > All applications** and search for **Draftable Legal** or the application ID `6c0ba8ea-12a2-4cae-82e7-857cda5862e9`. The app appears in your tenant after the first person signs in to it. If it is not there yet, use the link in the next step instead. **2. Grant admin consent** Open the app, then **Security > Permissions**, and select **Grant admin consent** for your organization. Sign in as an administrator, review the permissions Microsoft lists, and select **Accept**. Alternatively, replace `` in this link with your tenant domain or tenant ID, open it, sign in as an administrator and select **Accept**: ```text theme={null} https://login.microsoftonline.com//adminconsent?client_id=6c0ba8ea-12a2-4cae-82e7-857cda5862e9 ``` Afterwards your browser may show an error page, such as one saying it can't connect to `localhost`. That is expected: the approval is already recorded. If the address bar contains `admin_consent=True`, it worked. **3. Check the result** Refresh **Security > Permissions** and check that **Azure Rights Management Services** appears under **Admin consent**. To confirm users are signing in, open **Monitoring & health > Sign-in logs** in Microsoft Entra ID and filter on the **Draftable Legal** application. The resource for protected-file sign-ins is Microsoft Rights Management Services. Check both the interactive and non-interactive sign-ins tabs. ## Related articles * [Cleaning files protected by Microsoft Purview](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Cleaning-files-protected-by-Microsoft-Purview.md) * [Installing Draftable Clean Outlook Add-in](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Installing-Draftable-Clean-Outlook-Add-in.md) * [Using the Outlook Add-in](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Using-the-Outlook-Add-in.md) * [Troubleshooting: Outlook Add-in](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Troubleshooting-Outlook-Add-in.md) * [Release Log: Draftable Clean](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Release-logs-and-notes/Release-Log-Draftable-Clean.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.