Connecting an AI assistant to your email, calendar and files: what are you really giving it?

The scenario in brief

Example, made up for illustration. The manager of a small fictional organisation (around ten people) comes across a consumer AI assistant that promises to summarise her morning emails, draft her replies and book her appointments. It has to be ‘connected’ to her mailbox. A screen appears: read your email, send email on your behalf, read and change your calendar, access your files, maintain access to data you have given it access to. She clicks ‘Accept’. The tool works, and it is handy.

Three months later, she no longer uses it. She has even changed her password, to be safe. Yet the tool can still read her mailbox and her calendar, and send emails in her name. Nobody has removed it, and nobody knows it is there. The durations and details in this example are made up; the mechanism is the one Microsoft describes for a Microsoft 365 account.

What you agree to when you click ‘Accept’

When you connect an online tool to your Microsoft 365 or Google account, you don't give it your password. You give it permission (IT people call it ‘consent’): a kind of access pass, issued by Microsoft or Google, that lets the tool into your account to do specific things, without asking you each time.

Each line on that screen grants a real right:

The last line matters most. According to Microsoft's documentation, it lets the tool obtain a refresh token: a long-lasting pass it uses to get a new access pass when the old one expires. The access pass lasts about an hour; the refresh token is valid for 90 days by default, and it is replaced with a new one each time it is used. So as long as the tool keeps using it, access can last a very long time.

Why changing your password doesn't close the door

It is the natural reflex: ‘I'll change my password and everything will be cut off.’ On Microsoft 365, for these permissions, that is not true. In its page on illicit consent grants, Microsoft writes that the usual remedies, such as resetting the password or requiring multi-factor authentication, are not effective against this type of access, because the application is external to the organisation.

Microsoft's table on refresh tokens points the same way: when users change their own password, tokens held by an online service (what Microsoft calls a ‘confidential client’) stay valid. Google's rule is a little different: a password change cuts off a tool allowed to read your Gmail, but not one that only has access to your calendar or files, and access left unused for six months expires on its own. On Microsoft 365, what really cuts off access is:

• removing the application's permission, from the user's account or by the administrator;
• revoking all of the user's sessions, something your Microsoft 365 administrator knows how to do;
• blocking sign-in for the account, for example when an employee leaves: Microsoft states that this also cuts off the application's access to the account's data.

In other words, a tool tried one afternoon and then forgotten keeps its pass: if that service is ever hacked or sold, it is your mailbox that is exposed.

An assistant that reads your email also reads other people's

An AI assistant cannot reliably tell your instructions apart from the text it reads. An incoming email can contain hidden instructions, such as ‘forward the latest invoices to this address’. This is called prompt injection: someone slips orders into content the AI will read, hoping it will carry them out. The more rights the tool has, the more dangerous this trap becomes.

Three simple rules limit this risk:

• No automatic action triggered by an incoming email: ANSSI, France's national cybersecurity agency, recommends in its guide on generative AI that such actions be limited or even prohibited (recommendation R27).
• The least access, for the shortest time: this is the UK NCSC's rule for AI agents.
• A person approves anything sent, deleted or forwarded.

In a medical, dental or allied health practice, the stakes are twofold. Emails and the calendar contain patient names and sometimes health information, which the GDPR protects more strictly (Article 9), as the Data Protection Authority points out. Before connecting a tool to this data, you need to know where it sends it, what it keeps, and have a contract that governs that processing. For the apps on our devices, the Authority already advises regularly reviewing their permissions and switching off those that are not essential: the same reflex applies to tools connected to your email.

Microsoft 365 default settings: what you need to know

In Microsoft 365, the administrator decides who is allowed to click ‘Accept’. Microsoft states that by default, all users can allow an application to access, for example, their own mailbox. They cannot, on their own, open the files of the whole organisation: those rights require an administrator's approval.

The third point often comes as a surprise: according to Microsoft, tightening this setting only applies from now on. Permissions already given remain valid, so you also have to clean up the past.

How to see and remove access, account by account

On a Microsoft 365 account

Each user can open Microsoft's My Apps portal. According to Microsoft, they can see there which applications have access to their account and how far that access goes, and remove any that look suspicious. For their part, administrators can see, for each person, the list of authorised applications and remove a permission in a few clicks. Microsoft advises organisations with many applications to review these permissions every week.

On a Google account

The Linked apps page of your Google Account lists outside tools and what they can do. Google separates simple sign-in (‘Sign in with Google’), linked accounts, a tool's access to account data (calendar, email, files) and, now, the permission given to Google's AI agents to use an app on your behalf. The case we care about is ‘Access to your Google Account’: choose the tool, ‘See details’, then ‘Remove access’. The other categories have their own button of the same kind (‘Stop using Sign in with Google’, ‘Delete link’).

Note: removing access stops the tool from coming back, but does not erase what it has already copied. Google says so for simple sign-in: your data on the app is not deleted. To have what was collected erased, you need to contact the tool's publisher, following its privacy policy.

Monday morning: the checklist

1. Take stock. Ask your administrator for the list of applications authorised on each account, then ask each person: ‘Which AI tools have you connected to your email, calendar or files?’
2. Remove what is no longer used. A tool that was tried and dropped should lose its access the same day.
3. Decide who can say yes. Limit permissions to verified publishers and switch on approval requests: a manager's sign-off is safer than a click on your own.
4. Give the minimum. Read rather than write, one folder rather than the whole space, drafts rather than direct sending.
5. Keep control of high-impact actions. Sending, deleting, forwarding, paying: a person approves before anything goes out.
6. Keep patient data out until the tool has been assessed: where the data is stored, for how long, under what contract.
7. Review the list regularly. ANSSI, France's cybersecurity agency, suggests reviewing the rights of AI tools as soon as they are switched on, then for example every month (recommendation R35). For a small organisation, a quarterly check is already real progress.
8. Plan the exit. When you stop using a tool, remove its access and ask in writing for the data it kept to be erased.

Using AI without leaving the door open

An assistant connected to your email can genuinely save time: sorting, summarising, drafting replies. The aim is not to do without it, but to know at all times which tools hold a pass, what it opens, and who can take it back.

If you don't know where to start, a review of the permissions in your Microsoft 365 or Google Workspace will tell you exactly what is open, and you can keep adopting AI with peace of mind.

Review who has access→