# Adinand Email Cleaner for IT admins

HTML version: https://adinandemail.com/outlook/it-admins

Someone in your organisation wants to use Adinand Email Cleaner, an app that groups their Outlook inbox by sender on iPhone and iPad so they can clear bulk mail. This page has what you need to decide: who publishes it, the exact permissions it asks for and why, where the data goes, a link to grant consent for your whole organisation, and how to take it back.

## Who we are

Adinand Email Cleaner is published by **Adinand Innovations**. Support: [support@adinandemail.com](mailto:support@adinandemail.com). The app passed the App Defense Alliance’s CASA Tier 2 security assessment for its Gmail access ([Security page](https://adinandemail.com/security)); that assessment covers the Google side and is not a Microsoft certification.

## The application

- **Application (client) ID:** `3397b8d9-bcb1-4e4c-b587-995653705112`
- **Permission type:** delegated only — the app acts as the signed-in user, on that user’s own mailbox. No application (app-only) permissions.
- **Sign-in:** Microsoft’s own sign-in page (MSAL); the app never handles passwords.

## Permissions it asks for

Six delegated Microsoft Graph permissions. The middle column is Microsoft’s own description of each one (Microsoft Learn, [“Microsoft Graph permissions reference”](https://learn.microsoft.com/en-us/graph/permissions-reference), read 28 October 2026; the `profile` row read 31 October 2026); for every row Microsoft lists “AdminConsentRequired” as “No” for the delegated permission. The app does **not** ask for `Mail.Send` or any application permission.
| Permission | Microsoft’s description | Why the app needs it |
|---|---|---|
| `Mail.ReadWrite` Delegated · Admin consent required: No | “Allows the app to create, read, update, and delete email in user mailboxes. Does not include permission to send mail.” | List the Inbox, read message headers, and move the messages the user picks to Deleted Items (or Archive, or tag them with a category). The app does not read bodies and does not permanently delete.  |
| `MailboxSettings.ReadWrite` Delegated · Admin consent required: No | “Allows the app to create, read, update, and delete user's mailbox settings. Does not include permission to send mail.” | Create, list and remove the Inbox rules the user asks for (“Auto-trash: sender”).  |
| `User.Read` Delegated · Admin consent required: No | “Allows users to sign-in to the app, and allows the app to read the profile of signed-in users. It also allows the app to read basic company information of signed-in users.” | Needed to turn the message ids that search returns into the stable (immutable) ids every other call uses.  |
| `offline_access` Delegated · Admin consent required: No | “Allows the app to see and update the data you gave it access to, even when users are not currently using the app. This does not give the app any additional permissions.” | Keeps the user signed in between sessions instead of asking for their password each time.  |
| `openid` Delegated · Admin consent required: No | “Allows users to sign in to the app with their work or school accounts and allows the app to see basic user profile information.” | Sign-in.  |
| `profile` Delegated · Admin consent required: No | “Allows the app to see your users' basic profile (e.g., name, picture, user name, email address)” | Shows which account is connected and keeps accounts separate on the device: the account address is the sign-in’s user name, which Microsoft sends only with this scope. Microsoft’s sign-in library adds it to every sign-in on its own.  |

## Where the data goes

- **On the device only.** The phone talks to Microsoft Graph directly over HTTPS. Adinand Email Cleaner has no server, database or cloud that receives mailbox data.
- **Headers, never bodies.** The app asks Graph only for message ids, sender, subject, received date and internet headers — never `body`, `bodyPreview`, recipients or attachments.
- **Tokens in the device keychain.** On iPhone and iPad, Microsoft’s sign-in library keeps its tokens in the app’s own keychain group, not shared with other apps.
- **Nothing is permanently deleted.** Cleaning moves messages to the user’s Deleted Items folder. Rules the app creates use Graph’s `delete` action, which Microsoft defines as: “Indicates whether a message should be moved to the Deleted Items folder.” — not `permanentDelete` (Microsoft Learn, [“messageRuleActions resource type”](https://learn.microsoft.com/en-us/graph/api/resources/messageruleactions?view=graph-rest-1.0), read 28 October 2026).
- **Removing the account** in the app’s Settings deletes its local data and its sign-in from the device.

Full policy: [Privacy Policy](https://adinandemail.com/privacy-policy).

## Grant consent for your organisation

If your tenant does not let users consent to apps themselves, you can approve Adinand Email Cleaner for everyone. Microsoft’s admin-consent endpoint asks a tenant administrator to sign in and “approve all the permissions that you have requested in the scope parameter” (Microsoft Learn, [“Microsoft identity platform admin consent protocols”](https://learn.microsoft.com/en-us/entra/identity-platform/v2-admin-consent), read 28 October 2026). Enter your **tenant ID** — in the Microsoft Entra admin center, “Browse to Entra ID > Overview > Properties.” and “Scroll down to the Tenant ID section” (Microsoft Learn, [“How to find your tenant ID”](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant), read 28 October 2026).

The link has this shape:

`https://login.microsoftonline.com/TENANT-ID/v2.0/adminconsent?client_id=3397b8d9-bcb1-4e4c-b587-995653705112&scope=https%3A%2F%2Fgraph.microsoft.com%2FMail.ReadWrite%20https%3A%2F%2Fgraph.microsoft.com%2FMailboxSettings.ReadWrite%20https%3A%2F%2Fgraph.microsoft.com%2FUser.Read%20offline_access%20openid%20profile&redirect_uri=https%3A%2F%2Fadinandemail.com%2Foutlook%2Fadmin-consent`

After you approve or decline, Microsoft sends you back to [adinandemail.com/outlook/admin-consent](https://adinandemail.com/outlook/admin-consent), which shows the result. That page stores nothing and sends nothing on. Then ask your colleague to open the app again.

## How to revoke it for the whole organisation

In the Microsoft Entra admin center (Microsoft Learn, [“Review permissions granted to enterprise applications”](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/manage-application-permissions), read 28 October 2026):

1. “Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.”
2. “Browse to Entra ID > Enterprise apps > All applications.” and select Adinand Email Cleaner.
3. “Select Permissions.” — “To view permissions that apply to your entire organization, select the Admin consent tab.”
4. “Choose the permission you would like to revoke, then select the ... control for that permission.” then “Select Revoke permission.”

Microsoft notes one limit: “You can’t revoke permissions in the User consent tab using the portal.” Those need Microsoft Graph or PowerShell, which the same page covers. Revoking removes the app’s access to mailboxes; Inbox rules a user created through the app are ordinary rules in that user’s mailbox and are removed in Outlook under Settings > Mail > Rules (Microsoft Support, [“Manage email messages by using rules in Outlook”](https://support.microsoft.com/en-us/outlook/mail/manage-email-messages-by-using-rules-in-outlook), read 28 October 2026).

## Questions

Email [support@adinandemail.com](mailto:support@adinandemail.com) — we usually reply within 2 business days. Users’ own questions are answered on the [Outlook.com page](https://adinandemail.com/outlook) and in [Support](https://adinandemail.com/support).