OpsWork: what it reads, writes and never does.

What it reads

• Your email and files: read in your own Microsoft 365.
• A summary of each enquiry from your connected mailboxes.

What it writes

• Your records: saved in your own SharePoint.
• Invoice drafts recorded for your approval, with overdue invoices flagged for chasing.

Microsoft permissions

The OpsWork install wizard asks the signed-in administrator for these Microsoft Graph delegated permissions. They read organisational information, not only your sign-in:

• User.Read: the signed-in profile
• Application.Read.All: inspect existing applications and consent
• Sites.Read.All: find existing SharePoint sites
• Policy.Read.All: inspect security defaults and Conditional Access
• User.Read.All: resolve the users prepared for the install
• RoleManagement.Read.Directory: inspect directory roles
• AuditLog.Read.All: audit access
• AdministrativeUnit.Read.All: inspect mailbox administrative-unit membership
• RoleManagement.Read.Exchange: inspect Exchange roles and scopes
• openid: sign-in

Azure is a separate sign-in (Azure management, user_impersonation) so the install can create its resources in your subscription: an Owner is needed to assign the roles. The install then gives OpsWork's own managed identity access to the resources it creates: Cognitive Services User, Key Vault Secrets User, Key Vault Crypto Officer and Crypto User, Storage Blob Data Contributor and Monitoring Reader. Key and secret roles are real powers on those resources.

These are today's lists. Microsoft's own consent screen shows the exact request when an administrator approves.

What it never does

• Nothing goes out without your approval.
• Never used to train any model. This is guaranteed in the Data Processing Agreement.
• OpsWork prepares and records; it does not advise, approve or sign.

Where the data lives

• In your own Microsoft 365 and Azure. There is no central OpsWork copy of your project data.
• UK South only.
• Optional OCR uses Microsoft-managed UK South temporary storage, logically isolated per customer, after explicit customer-MD acknowledgement.