General information about template stores
It’s important to note that your templates are only ever handled on your computer and inside your own Microsoft 365 tenant. The permissions you grant to TemplateManager365 are used in your Outlook session to talk to Microsoft Graph, and are never transferred to us.
See our firewall section for the list of addresses the add-in needs to reach, if you want to restrict it at the network level.
Your templates and your Microsoft 365 security tokens are never transferred to our servers
In order to operate either version, TemplateManager365 requires a security token to access Microsoft 365 on your behalf. This token gives the add-in permission read and write templates into your mailbox or your Microsoft 365 group (OneDrive to be specific). Microsoft will give you different warnings when granting the permissions that the app can send this data to the internet. Because add-ins are software programs running inside Outlook, this is theoretically true. There is no way to limit the transfer of any data the add-in processes just to the local client as we also need to communicate with Microsoft Graph (the programming interface used to achieve what the add-ins functionality). But this is not unusual for our add-in, this is the case for all add-ins that interact with Microsoft 365.
TemplateManager365 was built to run inside Outlook. No server of ours is involved in processing your templates, so your token and your template content go nowhere except Microsoft’s own servers. The add-in does send a small amount of usage and error information, which contains no template content and is listed in full in the firewall section below and in our privacy policy.
Microsoft 365 permissions for Personal Edition
If you choose to store the templates in your personal mailbox (personal edition) the following permissions are required:
- Sign you in and read your profile: This is the general permission to allow you to sign into Microsoft 365.
- Read and write access to your mail: The personal store is a hidden folder in your Microsoft 365 mailbox therefore the plugin needs to be able to write and read email messages and subfolders of that folder. No other email folders are read or modified.
- Maintain access to data you have given it access to: Microsoft permissions are separated into access and refresh tokens. The access token is the first token you get and requires you to login. The refresh token then lets the plugin tell Microsoft it is still working on your behalf (for example while a template with large attachments is being saved or loaded) and get a refresh token to give the plugin continued access. This permission lets us keep working without asking you to sign in again every couple of minutes. Despite what the permission indicates the token is never transferred outside of your Outlook instance and therefore as soon as you close the plugin or Outlook you will be asked to login again and no operations can occur when the plugin is not loaded.
Microsoft 365 permissions for Team Edition
If you choose to store the templates in a Microsoft 365 group’s drive (team edition) the following permissions are required:
- Sign you in and read your profile: This is the general permission to allow you to sign into Microsoft 365.
- Read all groups: In order to list the groups you are a member of, the plugin needs to be able to read these.
- Full access to your files: The team edition stores templates in the drive of the Microsoft 365 group (also known as the “SharePoint Document Library” or “OneDrive for Business Drive”). Therefore the plugin needs to be able to read and write files in those drives. The plugin will always create a new root folder called TemplateManager365 to store the templates and only ever read or write files in that folder.
- Maintain access to data you have given it access to: Microsoft permissions are separated into access and refresh tokens. The access token is the first token you get and requires you to login. The refresh token then lets the plugin tell Microsoft it is still working on your behalf (for example while a template with large attachments is being saved or loaded) and get a refresh token to give the plugin continued access. This permission lets us keep working without asking you to sign in again every couple of minutes. Despite what the permission indicates the token is never transferred outside of your Outlook instance and therefore as soon as you close the plugin or Outlook you will be asked to login again and no operations can occur when the plugin is not loaded.
Required firewall permissions
Microsoft 365 add-ins are single page web applications, loaded from our webserver. If you restrict outbound traffic, these are the addresses the add-in needs:
| Address | Purpose | Required |
|---|---|---|
https://www.templatemanager365.com | Loads the add-in itself (HTTP GET) | Yes |
https://graph.microsoft.com | Reads and writes your templates (HTTP GET and POST) | Yes |
https://statistics.solinventum.com | Usage statistics: a one-way hash of your email address, which store you use, and how many templates and folders you have | No — blocking it does not affect functionality |
https://analytics.solinventum.com | Product analytics: which screens and actions are used | No |
https://*.ingest.sentry.io | Error reports, sent only when something fails | No |
Your templates are only ever exchanged with Microsoft Graph. Template content, message bodies, subjects, recipients and attachments are never sent to any of the other addresses, and your Microsoft 365 token never leaves your Outlook session.
The last three are optional. If your organisation prefers to block them, the add-in works normally — you will simply not appear in our usage counts, and we will not receive an error report if something goes wrong for you. Our privacy policy sets out exactly what each one contains.