Applicable plans: ❎ The free plan, ❎ The complete plan

1 – Principles

Waldo uses OpenID authentication to access Office 365 resources. It’s secure and standard. Want the technical bits? Check out Microsoft’s official doc:  OpenID Protocols.

These are OAuth-based permissions following Microsoft Azure standards. In short: Waldo accesses Microsoft Teams the same way a user does. It needs both:

• App-level permission (the consent)
• User-level authentication

No user login = no access. No sneaky shortcuts.

Waldo employees can’t identify your data. Ever.

2 – Default consent permissions

By default, Waldo needs a few basic read-only permissions to work:

• Maintain access to previously granted data
• Sign in and read user profile
• Read all users’ basic profiles
• Read names and members of chat threads

If you stick to minimal consent, Waldo has a few blind spots:

• No user avatars in notifications
• Can't identify teammates via managers
• No filtering users by Azure properties in admin portal
• Outlook sync doesn’t work

👉 That’s why we recommend extending consent.

3 – Admin consent permissions

When you enable the "default features":

• User.Read – get user info
• User.ReadBasic.All – get all users’ basic info
• Chat.ReadBasic – define teammates during onboarding

When you enable "user management features":

• User.Read.All – all users’ full info
• Place.Read.All – clean up meeting room users

When syncing from Outlook calendar to Waldo:

• Calendars.Read

When syncing from Waldo calendar to Outlook:

• Calendars.ReadWrite

When enabling emergency skills messaging:

• Chat.Create
• ChatMessage.Send

When allowing Teams Group Chat with calendar messages:

• Chat.Read

When filtering users by license or Azure Groups:

• Directory.Read.All

When messaging internal guests not using Waldo:

• Chat.Create – for guest booking messages
• ChatMessage.Send – also for guest booking messages

More details at: admin.hellowaldo.app/consent

4 – How to grant consent

Here's the full guide: How to grant consent