Fellow uses the OAuth2 protocol to connect to Microsoft 365 on behalf of users. OAuth2 ensures that Fellow can only access the specific resources it's been authorized for - these are called scopes. The sections below describe each scope, why it's needed, and which integration it applies to.
Scopes fall into two categories:
Delegated scopes: authorized by each individual user when they sign into Fellow.
Application scopes: authorized by an AD admin to pre-authorize Fellow access for all users in a tenant.
Delegated Scopes
Base scopes
Required for all users to log into Fellow and use it with a Microsoft 365 calendar.
Calendars.ReadWrite
Description: Read and write access to user calendars.
Why Fellow needs it: Core to Fellow's functionality. This scope allows Fellow to create, read, update, and delete calendar events — required for calendar sync and meeting note association.
Note: While Fellow can see attachment links on calendar invites, it cannot access the contents of those links.
User.Read
Description: Sign in and read user profile.
Why Fellow needs it: Allows users to sign into Fellow and allows Fellow to read the signed-in user's profile (name, email, company name).
Note: This scope includes the following OpenID Connect (OIDC) scopes: email, openid, profile.
People.Read
Description: Read users' relevant people lists.
Why Fellow needs it: Allows Fellow to read a scored list of people relevant to the signed-in user. This is used to suggest relevant teammates when sending notes or inviting coworkers. Fellow requests limited people/contact access for this purpose — this is a common question in security reviews.
offline_access
Description: Maintain a persistent connection via refresh tokens.
Why Fellow needs it: Allows Fellow to keep the Microsoft 365 integration active for background calendar sync and timely notifications, without requiring users to re-authenticate each time.
Tasks.ReadWrite (Microsoft To Do integration only)
Description: Read and write access to user tasks.
Why Fellow needs it: Required to sync Fellow action items with Microsoft To Do. This scope is only requested if the Microsoft To Do integration is enabled.
Microsoft Teams scopes (optional)
Required only if Fellow is used with Microsoft Teams. These scopes are requested incrementally when a user signs into the Fellow for Teams app.
Team.ReadBasic.All
Description: Read the names and descriptions of teams.
Why Fellow needs it: Allows Fellow to retrieve basic Teams information in order to send notes and add the Fellow tab.
Note: This scope does not provide the ability to read messages.
Channel.ReadBasic.All
Description: Read the names and descriptions of channels.
Why Fellow needs it: Allows users to post meeting notes to a Teams channel listed in Fellow.
Note: This scope only allows Fellow to see which channels exist. It does not provide the ability to read messages.
Teams Meeting Tab Auto-Add (optional)
To automatically add a Fellow tab to all meetings in Microsoft Teams, a workspace admin must enable this feature in Workspace Settings. The following additional scopes are required:
OnlineMeetings.Read
Description: Read online meeting details.
Why Fellow needs it: Allows Fellow to read meeting details on behalf of the signed-in user, required for tab installation in Teams meetings.
AppCatalog.Read.All
Description: Read all app catalogs.
Why Fellow needs it: Allows Fellow to read the Teams app catalog to verify whether the Fellow app is available for installation.
TeamsAppInstallation.ReadWriteForChat
Description: Manage installed Teams apps in chats.
Why Fellow needs it: Allows Fellow to check which apps are installed in a chat and install Fellow if it isn't already present. This scope does not grant access to application-specific settings.
TeamsTab.ReadWriteForChat
Description: Manage tabs in chats.
Why Fellow needs it: Allows Fellow to check which tabs are available in a chat and add a Fellow tab if one isn't already installed.
Application Scopes (Admin Consent)
The following scopes apply when an AD admin is performing a tenant-wide installation of Fellow for all users. They can also be granted via the https://graph.microsoft.com/.default scope in admin/application token flows for organization-wide setup.
If you're unsure whether this applies to your organization, these scopes are not required for standard individual user installs.
Calendars.ReadWrite
Description: Read and write calendars for all users in the tenant.
Why Fellow needs it: Allows Fellow to create, read, update, and delete calendar events across the organization. Required for tenant-wide calendar sync.
Note: While Fellow can see attachment links on calendar invites, it cannot access the contents of those links.
User.Read.All
Description: Read all users' full profiles in the tenant.
Why Fellow needs it: Allows Fellow to keep the user list in sync, including names, emails, and reporting hierarchy. Also used to deprovision users when they are no longer active in the tenant.
People.Read.All
Description: Read all users' relevant people lists.
Why Fellow needs it: Allows Fellow to search the full directory of the organization. Used to retrieve a complete user list and make relevant suggestions.
Directory.Read.All
Description: Read directory data.
Why Fellow needs it: Allows Fellow to read users, groups, and apps in the organization's directory without a signed-in user. Required to keep the user list in sync.
Group.Read.All
Description: Read all groups.
Why Fellow needs it: Allows Fellow to list groups and read group memberships, including access to group calendars that Fellow has been explicitly granted access to.
Note: Fellow uses this permission exclusively to access group calendars for which it has been given explicit access. It does not use this permission to read group conversations, files, or other group content.