A new scheduling tool promises to save your team time. An employee clicks “Sign in with Microsoft,” sees a permissions request, and hits Accept. Within seconds, the app is connected.
But what did they just agree to?
That permissions request may have given the app access to emails, files, or other sensitive business information. Most employees click through without checking what they’re approving.
Software as a service (SaaS) makes it easy for businesses to add new tools, but every integration introduces potential security risks. Reviewing SaaS app permissions before connecting a tool helps protect your data and prevent unnecessary access.
With the right approval process and managed IT support, businesses can take advantage of new applications without compromising security.
Why the Connection Matters More Than the App
According to Verizon’s 2026 Data Breach Investigations Report, third parties were involved in 48% of breaches, up from 30% the previous year. That’s a 60% increase and a reminder that even well-protected businesses face risks through outside vendors.
For Canadian businesses, there’s also a legal responsibility to consider.
Under the Personal Information Protection and Electronic Documents Act (PIPEDA), organizations remain accountable for personal information transferred to third parties for processing.
The Office of the Privacy Commissioner of Canada advises businesses to assess vendors’ privacy practices before sharing personal information and ensure comparable protection through contracts or other safeguards.
In other words, connecting an app doesn’t transfer your privacy obligations to the vendor. If that app exposes customer information, your business may still have to answer for how the data was protected.
What Is the App Actually Asking For?
Not all SaaS app permissions work the same way. According to Microsoft’s guidance on permissions and consent, there are two main types businesses should understand.
Delegated Permissions
Delegated permissions allow an app to access data on behalf of a signed-in user. The app’s access is limited by both the permissions granted and what that employee is authorized to access.
For example, a scheduling tool might need permission to read an employee’s calendar. But if someone with broader access approves the connection, the potential exposure could be much greater.
Application Permissions
Application permissions allow an app to access data without someone actively signed in. Depending on the permissions granted, it may be able to retrieve information across multiple accounts or the entire organization.
These permissions require administrator approval because they can provide extensive access to business data.
Permissions That Deserve a Closer Look
Before approving a new app, watch for requests such as:
- “Read and write all files”: May allow the app to view, modify, or delete files.
- “Read your mail” or “Send mail as you”: Could expose sensitive messages or allow the app to send emails on a user’s behalf.
- “Maintain access to data you have given it access to”: Allows the app to retain access even when the user isn’t actively signed in.
- “Read all users’ full profiles”: May expose employee information across the organization.
The key question is simple: Does this app actually need these permissions to do its job? If the requested access seems excessive, don’t approve it until IT has reviewed the connection.
Five Questions to Ask Before You Click Accept
SaaS app permissions show what a tool can access. These five questions help determine how the vendor will handle your data.
- What data can it access? Identify connected systems and whether sensitive customer, employee, or financial information is involved.
- Where is the data stored? The Canadian Centre for Cyber Security recommends knowing where providers store data, as privacy laws vary by country.
- How will the vendor use your data? Check whether customer information may be used for other purposes, including AI training.
- Is the provider trustworthy? Look for a verified publisher, clear privacy policy, and accessible security information.
- What happens when you leave? Confirm how data is returned or deleted, and revoke the app’s access when the service ends.
Put a Gate in Front of the Accept Button
Employees shouldn’t have to make security decisions on their own. Microsoft 365 administrators can control which apps users are allowed to approve.
Microsoft recommends restricting user consent to verified publishers and selected low-risk permissions. Apps requiring broader access can go through an administrator approval process.
This gives employees a straightforward way to request new tools while IT reviews the permissions before granting access.
However, changing consent settings doesn’t revoke existing approvals. Businesses should also review connected apps and remove unnecessary access. This can be part of a broader Microsoft 365 sharing audit or a review of external permissions in Teams and SharePoint.
Do You Know What Your Apps Can See?
Every connected app introduces potential security risks. Reviewing permissions, evaluating vendors, and controlling app approvals helps protect sensitive business data from unnecessary exposure.
For 35 years, Data First Solutions has helped businesses across the Greater Toronto Area manage and secure their technology. We can review your existing SaaS connections, strengthen approval processes, and support your PIPEDA compliance efforts.
Call us at 416-412-0576 or contact us online to get started.
Article FAQs
What are SaaS app permissions?
SaaS app permissions determine what information an application can access when connected to accounts like Microsoft 365. These may include emails, files, or contacts and are typically displayed during the approval process.
Is my business responsible if a third-party app leaks our data?
Under PIPEDA, businesses remain accountable for personal information transferred to third parties for processing. Using an outside vendor doesn’t eliminate your privacy obligations.
How do I stop employees from connecting risky apps?
In Microsoft 365, restrict user consent to verified publishers and selected low-risk permissions. Require administrator approval for apps requesting broader access.
