OnePane for IT admins
Someone in your organization wants to see their Outlook inbox and calendar on their OnePane start page, and Microsoft asked them for admin approval. This page has what you need to decide: what OnePane asks for, what it keeps, and how to approve or remove it.
What OnePane is
OnePane is a browser start page: weather, calendars, news, to-dos and notes on one page, plus optional Outlook Mail and Outlook Calendar widgets that show the unread count, the latest messages and upcoming events. Clicking a message or event opens it in Outlook. OnePane is made by SMW Digital (2395145 Ontario Inc.), a small company in Ontario, Canada.
Microsoft Graph permissions
All permissions are delegated (they act only as the signed-in user, on their own data). OnePane asks for each one only when the user adds the widget that needs it.
| Permission | Why | Asked when |
|---|---|---|
openid, profile, email, User.Read | Sign in, and show which Microsoft account is connected | Any Outlook widget |
offline_access | Stay connected without asking the user to sign in again every hour | Any Outlook widget |
Mail.Read | Unread count and latest messages in the inbox | Outlook Mail widget |
Calendars.Read | Upcoming events from the user's calendar | Outlook Calendar widget |
OnePane never asks for Mail.Send, Mail.ReadWrite, Calendars.ReadWrite, shared or other users' mailboxes, files, Teams or any application (app-only) permission. Its server only passes through requests for the user's inbox and calendar view.
What OnePane stores, and where
- Mail and events: not stored. They're fetched from Microsoft when the page loads and sent to the user's browser.
- The connection token (Microsoft refresh token): encrypted, stored with the user's OnePane account on Amazon Web Services in Canada (Montreal region). Microsoft replaces it each time it's used. It's deleted when the user clicks Disconnect.
- The Microsoft account's email address, to show which account is connected.
- No ads, no tracking, nothing sold. Details in the privacy policy.
App details
| App name (Microsoft Entra) | OnePane.page |
| Application (client) ID | 2de32039-a9bb-4733-99c9-d43a05951834 |
| Publisher | SMW Digital (2395145 Ontario Inc.), Ontario, Canada |
| Account types | Work or school accounts (any organization) and personal Microsoft accounts |
| Redirect addresses | https://onepane.page/api/ms/callback, https://onepane.page/app/ |
| Publisher verification | In progress with Microsoft |
How to approve OnePane for your organization
Option 1: approve a request (admin consent workflow)
If your organization has admin consent requests turned on, the user's request is already waiting for you.
- Open the Microsoft Entra admin center → Identity → Applications → Enterprise applications → Admin consent requests.
- Open the request for OnePane.page and check the permissions listed (they match the table above).
- Click Review permissions and consent, sign in as an administrator and accept.
Option 2: consent while connecting the widget yourself
Works for anyone allowed to grant tenant-wide consent (for example a Global, Cloud Application or Application Administrator).
- Go to onepane.page/app and create a free account (every new account includes 7 days of Pro, which has the Outlook widgets).
- Add the Outlook Mail widget and click Connect Microsoft account.
- Sign in with your admin account. On Microsoft's permission screen, tick Consent on behalf of your organization, then click Accept.
- To approve calendar access too, add the Outlook Calendar widget and repeat. Approve only the one your users need if you prefer.
- Click Disconnect at the bottom of the widget afterwards if you don't want your own mailbox connected. The organization's approval stays.
Menu names can differ slightly between versions of the Entra admin center.
How to remove it
- A user: click Disconnect at the bottom of an Outlook widget. OnePane deletes the token right away.
- An admin, for everyone: Entra admin center → Enterprise applications → OnePane.page → Properties: set Enabled for users to sign in? to No, or Delete the enterprise application, which also removes the permissions it was granted.
Questions or a security review
Email steve@smwdigital.ca or use the support page. Need OnePane for a whole team, with one invoice? See OnePane for teams.
Questions
Can OnePane send email or change calendars?
No. It only has read-only, delegated access (Mail.Read and Calendars.Read) to the signed-in user's own inbox and calendar.
Does OnePane store our email?
No. Messages and events are fetched from Microsoft when the page loads and sent to the user's browser. Only an encrypted connection token and the account's email address are stored, in Canada.
Why do users see Need admin approval?
Your organization only lets administrators approve apps that read company data. An admin can approve OnePane once for everyone, using the admin consent request or by consenting while connecting the widget.
Can we approve calendar but not mail?
Yes. Each permission is asked for separately, by its own widget, so you can approve Calendars.Read without Mail.Read.
Where is the data hosted?
On Amazon Web Services in Canada (Montreal region).