For IT administrators
Helm and Microsoft 365
This page is for Microsoft 365 administrators reviewing a consent request for Helm: which permissions the app asks for, what it uses them for, and how its access can be limited or revoked.
About Helm
Helm is an AI-integrated CRM: deals, customer history, email and to-dos in one place. It is developed by Mesterséges Intelligencia Központ Kft. (1172 Budapest, VIII. utca 2., Hungary). Helm is in early access: it is used in the developer's own businesses and at one partner company.
The app at Microsoft
| Display name | Helm |
|---|---|
| Application (client) ID | b7d7ad86-a097-497e-b295-88cb55fa908d |
| Publisher | Mesterséges Intelligencia Központ Kft. |
| Account type | multitenant: usable with any organisation's Microsoft Entra account and with personal Microsoft accounts; delegated permissions only |
| Redirect URIs | https://mik. (the developer's Helm installation)https://logiscool. (another address of the same installation)https://mik-sandbox. (the installation's test environment)http://localhost: (developer machine) |
What it asks for and why
All of these are delegated permissions: Helm acts on behalf of the signed-in user and reaches only that user's own mailbox and calendar. The mailbox and the calendar are connected with one consent.
| Permission | What it is for |
|---|---|
openid, email, offline_ | Signing in, and keeping the connection without a daily sign-in. |
User.Read | The signed-in user's name and email address, so Helm knows which mailbox was connected. |
Mail. | Showing the mailbox's messages in Helm, next to the customers. Writes happen only on the user's action: marking as read (opening a message does this), the follow-up flag, moving, archiving, and deleting into Deleted Items. There is no permanent delete. |
Mail.Send | Sending as the user, only when the user chooses Send in Helm, with an undo window of a few seconds. There is no scheduled, automatic or AI-started sending. |
Calendars. | Showing the user's own calendar events, by default 90 days back and 365 days ahead. Writes happen only if the account's calendar-write switch is turned on in Helm (it is off by default); then Helm creates, updates and deletes, in the user's calendar, events edited in Helm's calendar and interview bookings, and writes events linked to CRM records into the organiser's personal (not shared) account. |
What it does not ask for
- Application (organisation-wide) permissions: Helm cannot reach other users' mailboxes or calendars.
- Access to files, OneDrive, SharePoint, Teams or other directory data.
Limiting access to one user
By default, consent lets every user in the organisation use the app. To limit it to one user, in the Microsoft Entra admin center:
- Entra ID › Enterprise apps › All applications › the app › Properties: "Assignment required?" = Yes, then Save.
- In the same app, Users and groups › Add user/group: only the requesting user.
According to Microsoft's documentation, an app that requires assignment needs its permissions consented by an administrator, and users who are not assigned cannot sign in to it.
Revoking access
- Administrator: Entra ID › Enterprise apps › the app › Permissions › Admin consent › the permission's "…" › Revoke permission. The app can also be disabled (Properties: "Enabled for users to sign-in?" = No) or deleted. Revoking does not stop a new consent request from arriving later.
- In Helm: disconnecting the mailbox deletes the stored access tokens and stops synchronisation. Helm does not revoke the consent given at Microsoft; that is done as above.
Where the data is, and who sees it
- Storage: the Helm installation's database runs in Railway Corporation's cloud, in the European Union (the Netherlands).
- What is stored: the envelope of synchronised messages (sender, recipients including Cc and Bcc, subject, date, flags) and their first lines, by default from the last 90 days, and an older message only when a search started in Helm brings it up; a message's full text once it has been opened in Helm; an attachment of at most 2 MB once it has been downloaded; the full text of messages sent from Helm; the subject, short description, place, times, organiser, attendees and Teams link of calendar events. Access tokens are stored encrypted. Messages are not deleted automatically, and after a disconnect they stay in the database until the developer deletes them on request; they no longer show in the mailbox, but they still show on customer timelines.
- Who sees it in Helm: Helm connects a mailbox as a shared account by default, which the installation's users with mailbox access can see (for an account installed from the Connectors page, that connector's permissions decide, administrators included). A personal account is visible only to the person who connected it. The subject and first lines of messages exchanged with addresses that are customers in the CRM, and the title and place of meetings a customer attended, also appear on that customer's timeline, from personal accounts too; everyone who can open the customer's record sees them, whatever their mailbox access.
- AI: mail or calendar content reaches an AI provider in these cases:
- When a user opens an incoming message and holds the AI and send permissions: Helm then requests reply suggestions without being asked, sending at most the thread's 10 newest messages, up to 2,000 characters each and 12,000 in all.
- When a user asks for a summary or a draft (at most the same), or for a translation (only the opened message, up to 8,000 characters).
- When a user asks for a customer-timeline summary or a draft email from the timeline: at most 150 timeline entries, up to 600 characters each (subjects and first lines of messages, titles and places of meetings, notes, earlier summaries).
- When a user asks the assistant about the calendar: the title, time, place and organiser of events in the calendars that user can see. The assistant cannot reach the mailbox.
Contact
Questions, requests or deletion requests: hello@youhavethehelm.com · Mesterséges Intelligencia Központ Kft. How data is handled: privacy notice.