For IT administrators
Ambital and your Microsoft 365 tenant
Someone in your organisation has asked you to approve Ambital. This page tells you exactly what it asks for, what it does with the data, and how to withdraw access — so you can decide without having to email us.
Last updated: 25 August 2026
We never send email
Ambital drafts; a human presses send. We do not request Mail.Send, so sending on a user's behalf is not technically possible.
Calendar first, nothing else by default
A new connection asks for calendar access only. Mail and files are requested separately, later, and only if that user turns them on.
Tokens encrypted at rest
OAuth tokens are encrypted with AES-256-GCM before they touch the database, and are never written to logs.
Database in the UK/EU
The primary database is hosted in the London region.
What Ambital is
Ambital is a UK-built operations and financial-management platform for consultants, fractional executives and independent professionals — projects, time, invoicing and client reporting in one place. It is operated by Ambital Ltd (company number 17319695), registered in England.
The person asking you to approve it is most likely working with your organisation and wants their meetings with your team to appear against the right project.
Exactly what we request, and why
All permissions are delegated — Ambital acts only as the signed-in user, and can never see anything that user could not already see themselves. There are no application permissions, and no directory-wide access.
Requests are incremental. Approving the tenant does not switch everything on: each user still chooses which services to enable, and each additional service triggers its own consent.
| Graph scope | When | What it allows | Why we need it |
|---|---|---|---|
User.Read | At connect | Reads the signed-in user's own name and email address. | So the connected account is labelled with the right identity in Ambital. |
Calendars.ReadWrite | At connect | Reads events from the user's own default calendar, and writes events they create in Ambital back to it. | Meetings appear against the right project, and Teams join links come through with them. |
Mail.ReadWrite | Only if mail is enabled | Reads the user's own mailbox and creates drafts in it. Does not permit sending. | Project email threads in one place, and AI-assisted replies saved as drafts for the user to review. |
Files.Read.All | Only if files are enabled | Read-only access to OneDrive and SharePoint files the user can already open. | Attaching an existing document to a project. Ambital never modifies or deletes files. |
openid, email, profile, offline_access | At connect | Standard sign-in claims, plus a refresh token so the user isn't asked to sign in repeatedly. | Required by OAuth for any long-lived connection. |
What Ambital never does
- Sends email as a user. The scope that would permit it is deliberately not requested.
- Modifies or deletes files. File access is read-only.
- Reads other people's mailboxes or calendars. Delegated access covers the signed-in user only.
- Reads your directory. No user, group or device enumeration.
- Sells data or uses it to train AI models.
What actually reaches Ambital
With calendar enabled — the default and, for most users, the only thing they ever turn on — Ambital reads events from that user's own default calendar in a rolling window of 90 days back and 60 days forward, and stores the title, date and duration, location, join link, description and attendee list against the matching project.
That means meeting details involving your staff can be stored in Ambital, in the same way they would be if the user kept notes in any other tool. Attendees are matched to existing records; no new contact is created for someone the user does not already work with.
If mail is enabled, message content is encrypted at rest and decrypted only when displayed to that user. Ambital is a processor for this content — the customer is its controller. Our data processing agreement sets out those terms.
How it is protected
Encryption
OAuth tokens, synced message bodies and other sensitive fields are encrypted with AES-256-GCM before storage. Tokens are never logged.
Tenant isolation
Every record is scoped to a single customer organisation and filtered on every read and write, enforced by an automated check in our build.
The primary database is hosted in the UK/EU (London region). Application hosting and file storage run on US-based providers under the UK International Data Transfer Addendum and Standard Contractual Clauses. The full sub-processor list is in our privacy policy.
Revoking access
Access can be withdrawn at any time, from either side:
- You, for the whole tenant — in the Microsoft Entra admin centre, under Enterprise applications → Ambital → Properties, delete the enterprise application or disable user sign-in.
- The user, for their own account — disconnecting in Ambital deletes our stored tokens immediately. They can also revoke consent at myaccount.microsoft.com.
Either action stops all future access. Data already synced is deleted on request under the customer's agreement with us, or when they close their account.
Publisher verification
Microsoft publisher verification is in progress and not yet complete, so the consent screen will not show a verified-publisher tick yet. We would rather say so here than have you discover it on the approval page. The app registration is owned by Ambital Ltd at the domain ambital.co.uk; if you would prefer to wait until verification lands, that is a reasonable call.
Questions before you approve
We would rather answer a question than have you approve something you are unsure about.