OAuth Scopes Explained for Email Tool Buyers

Gmail OAuth scopes explained: when you connect an email app to Gmail or Outlook, you grant a specific list of permission tokens called scopes. Those tokens define the ceiling of what the app can do. An app holding only a read scope can see your messages but cannot touch, move, or send them. An app holding a modify scope can archive, label, and delete. An app holding a send scope can compose and deliver messages in your name.

Most buyers click Allow on the consent screen without reading the scope list. This guide maps every relevant Gmail and Microsoft Graph mail scope to plain English — what each one permits, when an email tool legitimately needs it, and how to verify or revoke what you have already granted.

How OAuth scope tokens work#

OAuth 2.0 is the protocol that governs how third-party apps access resources on your behalf without handling your password. The scope is the part that limits what an app receives permission to do. When an app redirects you to Google or Microsoft's consent screen, it sends a specific list of scope strings. If you approve, the provider issues an access token that is cryptographically limited to those scopes.

The token is persistent. It does not expire when you close the app or end a session. It remains active until you explicitly revoke it from your account's security settings, or until the app deletes the token itself. In a Google Workspace account, an administrator can approve scopes domain-wide, which bypasses the per-user consent screen entirely. When an admin pre-approves a scope, every user in the organization effectively grants that permission the moment they connect the app.

If an app later needs a permission it did not originally request, it cannot silently expand its own scope. It must send you back through a new consent screen requesting the additional token. RFC 6749 defines this model; the scope string you see on the consent screen is the authoritative list of what the app can do.

What the Gmail OAuth scopes actually allow#

Google publishes the full scope reference for the Gmail API. The scopes most relevant to email tools are in the mail group. Each grants a different ceiling of access, and a legitimate tool should be able to justify every scope it requests by naming the specific product feature that requires it.

What Microsoft Graph mail permissions allow#

Microsoft Graph uses a permission model structurally similar to Gmail's, but the scope strings and the granularity differ. Mail permissions are documented in the Microsoft Graph permissions reference. The same principle applies: every permission the app holds should map to a named feature.

Why read-only is rarely enough for an AI email assistant#

An app limited to gmail.readonly or Mail.Read can surface information but cannot reduce inbox load. It can tell you that fifty threads arrived while you were in meetings. It cannot archive the newsletters, label the support requests, or send the follow-up you approved.

For an assistant that actively manages email, the minimum scope set is read (to understand context), modify or Mail.ReadWrite (to file, archive, and label), and send or Mail.Send (to deliver approved replies). Tools that also manage filters or update your signature need additional scopes beyond the mail group.

This is the model working as intended. The scope architecture forces every capability expansion to be an explicit permission decision. Read-only is not a limitation an assistant works around — it is a ceiling that maps to a narrower category of tool, one that informs but does not act.

Common misconceptions about email app permissions#

The permission expires when the session ends. It does not. OAuth access tokens refresh automatically as long as the app holds a valid refresh token. Closing the app's browser tab does not revoke anything. The connection remains live until you revoke it from your account's security settings.

Read-only means the app cannot see sensitive messages. It means the app cannot write or send — it does not restrict which messages it can read. An app with gmail.readonly can read every message in your inbox, including confidential threads. Read-only is a write restriction, not a content filter.

Deleting the app inside the app's own settings revokes the Gmail or Outlook permission. Not always. Revoking from within a product removes the app's stored token copy, but the underlying OAuth grant in Google or Microsoft's system is only reliably revoked from your account's own security page.

A Workspace admin pre-approving a scope means only the admin has that access. Pre-approval removes the per-user consent screen for every user who connects the app. The scope grant is per-user — each connected user holds the full scope set the admin approved — but the friction of clicking Allow individually is gone.

How AI Emaily handles scope requests#

We build AI Emaily. When you connect a Gmail mailbox, AI Emaily requests gmail.modify and gmail.send — the two scopes required for triage actions and approved replies — and nothing beyond those for mail. Connecting an Outlook account uses Mail.ReadWrite and Mail.Send on the same principle: the scopes that match what the assistant actually does, with no extras. Our full scope justification is published at aiemaily.com/security, and you can verify what was granted at any time from your Google Account security page or Microsoft account privacy settings without asking us.

How to review app permissions in Google#

1. 1

   Open your Google Account security page

   Go to myaccount.google.com/security and scroll to the Third-party apps with account access section.

2. 2

   Select the connected app

   Click the app name to expand the detail view. Google shows the exact scope string the app was granted, the date of the grant, and which Google Account it is connected to.

3. 3

   Read the scope list against the tables above

   Each scope should map to a feature you actively use. A scope without a named justification from the vendor is worth asking about before renewing or expanding access.

4. 4

   Revoke access if needed

   Click Remove Access. The token is invalidated immediately. The app loses mailbox access within seconds. No action inside the app is required.

How to review and revoke access in Outlook#

For a personal Microsoft account, go to account.microsoft.com, open Privacy, then Apps and services. Each connected app lists the Microsoft Graph permissions it holds and the date of the grant. Click the app name for detail, then select Revoke to invalidate the token.

For a Microsoft 365 workplace account, permissions are managed by your IT administrator in the Microsoft Entra admin center under Identity, then Applications, then Enterprise Applications. Individual users can view their own grants at myapps.microsoft.com but may not be able to revoke them if the admin has pre-approved the scopes organization-wide. Revocation in that case requires an admin action in Entra.

One point that applies to both providers: revoking from within the app's own settings is not guaranteed to revoke the underlying OAuth grant. Always confirm revocation from the provider's security page. If the scope no longer appears there, the grant is gone.