Outlook

The label on the consent screen is the display name of that same app registration. This connection is a delegated sign-in for one person. It is not a tenant-wide application permission, and it does not include a native HubSpot or Salesforce connector.

The Outlook app

Application (client) ID	03477409-6ad4-44b8-a91c-4b1a6217c82e
Sign-in	Multi-tenant. Microsoft endpoint login.microsoftonline.com/common. Each person signs in with their own work account.
Redirect URI	https://app.getkali.io/api/auth/microsoft/callback
Publisher verification	Microsoft shows a verified-publisher check on the consent screen when the app publisher is verified. Match the app by the client ID above in the Entra admin center, under Enterprise applications, to see that status. KALI cannot mark itself verified inside your tenant.
Who consents	The user who clicks Connect Outlook. These are delegated permissions, so Microsoft does not require tenant-wide admin consent for them. If your tenant blocks user consent for outside apps, an admin approves KALI once for the organization, and each person still signs in afterwards. Admin approval is a property of your Entra policy, not an application permission in KALI.

Permissions

All four are delegated permissions. KALI calls Microsoft as the signed-in user (/me). There is no application permission, no Exchange application access policy, and no app-only access to other mailboxes.

Scope	Why it is requested
offline_access	Keeps a refresh token so follow-ups can send after the browser session ends.
User.Read	Reads the signed-in account’s id, name, and email so the mailbox is stored against the right person.
Mail.ReadWrite	Reads mail to detect replies and to show a lead’s conversation, and writes draft state when sending. Microsoft’s mail permissions apply to the whole mailbox. They cannot be limited to one folder.
Mail.Send	Sends follow-up email as the signed-in mailbox.

This connection does not request Calendars.ReadWrite, Calendars.Read.Shared, OnlineMeetings.ReadWrite, OnlineMeetingArtifact.Read.All, or User.ReadBasic.All. Those belong to a separate sign-in (an Outlook calendar sender, or Microsoft Teams) and are not part of Connect Outlook.

Access is the mailbox of the account that consents. To keep it off personal mail, sign in as a dedicated mailbox, such as a shared mailbox the sender can open as themselves. Microsoft does not offer a folder-only permission KALI can request instead.

What KALI reads and sends

What it reads. Microsoft notifies KALI when a new message is created in Inbox. That notice does not include the message body. KALI then reads recent Inbox mail and messages involving a prospect so it can match a reply to a follow-up it sent (by conversation and by In-Reply-To / References). A match from the prospect stops the sequence and the reply is stored on that lead. Automatic replies such as out-of-office are ignored. Opening a lead in KALI loads the conversation with that address, including earlier mail with them, so the thread is complete.

KALI staff with platform-admin access can also open a support view of the connected mailbox: Inbox, Sent, Junk, Archive, Deleted, and Drafts, including a message and its attachments. People in your workspace do not get that folder browser. They see the lead conversation and can reply from it.

What it sends. Follow-ups go out from the connected mailbox’s own address, so replies come back to that person. Nothing sends until the workspace switch Show-up sequences is on, and that switch stays off until the mailbox has a signature. A test message can be sent from Sending inbox.

Approval. Human approval is off by default. Turn it on under Show-Up Sequences, Human approval. While it is on, AI-written follow-ups stay in Needs approval until someone approves them. You can send each request to the mailbox that will send the email. Template sequences send when the workspace switch is on; the approval switch governs AI copy.

Calendar. This connection does not read or write the calendar, and it does not create Teams meetings.

Data handling

• Where. The app runs at app.getkali.io. Mailbox tokens, follow-ups, and matched replies are stored in KALI’s PostgreSQL database on Neon. Ask your KALI contact for the current database region if the review needs a specific region in writing.
• What is kept. The follow-up KALI sent, and a reply that matched a prospect, stay on that lead for as long as the workspace keeps the lead. There is no separate short retention window for mailbox content.
• What it is used for. Sending the sequence, stopping it when the prospect replies, and showing that thread to your team. KALI does not train its own models on mailbox content. When AI copy is on, the draft is written through OpenRouter from campaign context: the lead, the invite that booked the meeting, earlier KALI emails in that sequence, and an optional public page from the lead’s company site. The mailbox is not uploaded for that draft.
• Tokens. The access token and refresh token are stored on that mailbox connection and used only to call Microsoft for it. KALI refreshes the access token as it expires. Microsoft may rotate the refresh token; KALI stores the new one.
• Revoke in KALI. Show-Up Sequences, Sending inbox, remove the mailbox. That deletes the stored tokens and the Inbox subscription. Sends stop.
• Revoke in Microsoft. Removing it in KALI does not delete the Entra grant. The signed-in user can revoke it at myaccount.microsoft.com/permissions. An admin can remove the enterprise application, matched by the client ID above. The next refresh then fails and KALI marks the mailbox disconnected.
• Reports. The DPA, and any SOC 2 report, ISO 27001 certificate, or penetration-test summary, is sent to your security team by your KALI contact. Those files are not published on this page.

Network and setup

Allow these names. KALI does not publish a static IP list, and the mailbox connection does not require one: mail calls go from KALI to Microsoft, not into your network.

• app.getkali.io — the app, the OAuth redirect, and the Inbox notification URL https://app.getkali.io/api/microsoft/mail-webhook
• getkali.io — this site
• notify.getkali.io — KALI’s own notification mail, such as a disconnect alert. Follow-ups are not sent from this domain.
• login.microsoftonline.com and graph.microsoft.com — Microsoft sign-in and mail
• openrouter.ai — AI draft text, only when that feature is on

Connect Outlook

1. Sign in to KALI.
2. Left menu: Reminders, then Show-Up Sequences.
3. Open Sending inbox.
4. Click Connect Outlook.
5. Choose the work account and accept. If Microsoft says an admin must approve the app, send your admin the client ID on this page and approve it once, then repeat the sign-in.
6. Back on Sending inbox, add the mailbox signature. Leave Show-up sequences off until you want mail to start. Turn on Human approval first if every AI follow-up should wait for a person.