Sumnote for Microsoft 365 admins

Sumnote turns meetings into transcripts, summaries, and proposed tasks and decisions that people review. With Microsoft 365, the Microsoft Teams meetings people organize and record come into Sumnote from their own OneDrive, their Outlook calendar can stay in step with Sumnote, and the Sumnote app brings their work into Microsoft Teams. Nothing joins a call: meetings are recorded by Microsoft Teams as they always are.

There are two levels, and you decide on both:

• Each person’s own account. People connect their own Microsoft account in Sumnote, and Sumnote then acts only as them, with their own access. Many organizations let people approve an app like this for themselves; if yours doesn’t, they see Microsoft’s Need admin approval screen.
• Your organization. A Sumnote workspace owner or admin can connect their workspace to your organization, with one approval from you. It is the same approval as for people’s own accounts, so after it nobody meets Need admin approval, and it lets your Microsoft Teams admin add the Sumnote app. Approving connects nobody: each person still connects their own account, and only their own recordings come in.

Sumnote is published by Sumnote Inc., Ontario, Canada. In your Microsoft Entra admin center it appears under Enterprise apps as Sumnote and, if you approve it, Sumnote Conversation Reader.

When people see Need admin approval, approve Sumnote in the Microsoft Entra admin center or from Microsoft’s admin approval request. When a Sumnote workspace asks to connect your organization:

1. 1

   Open the link you were sent

   A Sumnote workspace owner or admin asks from their workspace (Workspace → Integrations → Microsoft Teams) and sends you a link. Its page says which workspace asked, and who. The link works for 30 days, and you need no Sumnote account.
2. 2

   Sign in to your organization

   Choose Sign in with Microsoft to approve and sign in with your admin account. If Privileged Identity Management keeps your role eligible, activate it first.
3. 3

   Review and accept

   Microsoft shows every permission on Sumnote’s app registration, for everyone in your organization (What you approve). Accept, and the workspace’s card shows your organization as connected.

Good to know

• Who can approve: a Global Administrator, Privileged Role Administrator, Application Administrator, or Cloud Application Administrator. Anyone else ends on Your account can’t approve apps, and nothing changes.
• What Sumnote keeps: your organization’s id, name, and default domain, and, as the admin who approved, your name and your id in your directory. Nothing else of your sign-in.
• One organization connects to one Sumnote workspace. A second workspace asking for it is told it is taken.
• A new permission needs a new approval. An approval covers only what Sumnote asked for at the time. If Sumnote later asks for more (as it did for Auto-record in Teams), approve it again from a person’s link or the Microsoft Entra admin center.

Sumnote’s sign-in app asks for these Microsoft Graph permissions, all delegated: it acts only as the person who signed in, with that person’s own access. Under Microsoft’s default consent settings, the calendar and online meetings permissions need an admin’s approval.

• openid, profile, email: signing the person in, and showing which account is connected.
• offline_access: checking for new recordings without asking the person to sign in each time.
• User.Read: the person's name and email address.
• Files.Read: finding and downloading the Microsoft Teams meeting recordings in the person's own OneDrive.
• Calendars.ReadWrite: only once the person turns on their Outlook calendar in Sumnote: bringing their Outlook meetings in, and putting the meetings they schedule in Sumnote on their calendar.
• OnlineMeetings.ReadWrite: asked with the Outlook calendar: reading and setting the Record and transcribe automatically option of the Microsoft Teams meetings the person organizes, which Sumnote keeps the same as its Auto-record.
• Use Sumnote in Microsoft Teams (access_as_user): Sumnote's own permission, used by the app's My Work tab to know who is signed in; it opens nothing else in Microsoft 365.

What Sumnote can and cannot reach

• Only the signed-in person’s own files, and of those, only Microsoft Teams meeting recordings. To notice a new recording, Sumnote asks the person’s OneDrive what changed, and passes over everything else without opening it or keeping it.
• It never creates, changes, moves, or deletes a file. With a person’s Outlook calendar on, it keeps their calendar in step with the meetings they schedule in Sumnote; with Auto-record, it sets one option on the Microsoft Teams meetings they organize, and puts each back as they last set it when they turn their calendar off or disconnect.
• Out of reach: recordings of meetings held in a channel (kept in the team’s SharePoint site), anyone else’s OneDrive, calendar, or meetings, and mail, which Sumnote doesn’t ask for.
• Sumnote keeps the audio of each recording it brings in, to transcribe it and play it back. The video stays in the person’s OneDrive.

The Sumnote app is a bot and a My Work tab. It asks for no Microsoft Graph permissions and no resource-specific consent, and it never joins a call. The tab signs people in through Sumnote’s sign-in app above, so the Microsoft Teams admin center lists that app for Sumnote.

1. 1

   Get the package

   Once your organization is connected, a workspace owner or admin downloads Sumnote’s app from their card (Download the Teams app) and gives it to you.
2. 2

   Upload it

   In the Microsoft Teams admin center, open Teams apps → Manage apps → Upload new app and upload the package. Anyone allowed to use it can then add it to a team, a chat, or their own Microsoft Teams.
3. 3

   Install it for everyone (recommended)

   Then everyone has the Sumnote app’s chat from the start, and the buttons on its first reminder work at once. With app centric management: Teams apps → Manage apps, select Sumnote, Edit installs, choose everyone or the groups you want, and Apply. Otherwise: Teams apps → Setup policies → Global (Org-wide default), under Installed apps add Sumnote, and Save. Microsoft says a change can take a few hours to reach everyone.

What it sees

• Where it has been added (a team, a group chat, someone’s own Microsoft Teams), and the people there: their names, the address they sign in with, their mailbox address, and whether they are a guest. Sumnote uses these only to match people to members of the connected workspace, and leaves out people a shared channel brings in from other organizations.
• In a team, the names of its channels, when a workspace owner or admin opens Channels in Sumnote to link them to projects.
• Of the messages in a channel or chat, only those sent to it: a command from the / menu, a message that mentions it, or one someone sends it with Send to Sumnote, and only in a channel linked to a project or the chat of a meeting that is in a project. Sumnote keeps only the quotes that back what it found, for 30 days.

What it posts

• When it is added to a team, one card in the channel it was added from, where a workspace owner or admin can link that channel to a project.
• In a linked channel, only what a workspace owner or admin turns on, channel by channel: meeting recaps, a brief before each of the project’s meetings, and a weekly status report.
• In a meeting’s chat, only for a project whose admins or managers turned it on: what is still open before each meeting, and what came out of it afterwards. Everyone in the chat sees the decisions and open questions, including people outside your organization, and each person sees their own items.
• In each person’s own chat with the app: reminders about the tasks they hold, notes when someone else changes one, and answers to what they ask.

A new version: when Sumnote adds something to its app, a workspace owner or admin downloads it again, and you upload it in place of the old one (Teams apps → Manage apps, select Sumnote, Upload file). People’s chats and the places it is in stay as they were.

A second Sumnote app, separate from the sign-in app, which a workspace owner or admin may ask you to approve from their card or with a link. It holds two Microsoft Graph permissions, both application (not delegated): ChannelMessage.Read.All and Chat.Read.All, which Microsoft describes as reading all channel messages and all chat messages in the organization.

• Sumnote uses them only when someone sends it a message with Send to Sumnote, in a channel linked to a project or a project meeting’s chat. It then reads that thread, or the conversation just before the message (up to 15 messages), and nothing else, and never reads anything on its own.
• Each night it reads again the messages it quotes from the last 30 days, to remove the quote of any message deleted or edited since.
• Microsoft’s consent page also lists Sign in and read user profile, which Microsoft adds to any app’s first approval. Nobody signs in to the reader, so it goes unused.
• It is separate so that approving Sumnote for people’s recordings and calendars never grants reading chats. Without it, Send to Sumnote reads only the one message it is sent.

• Sumnote itself: in the Microsoft Entra admin center, open Enterprise apps → Sumnote → Properties, set Assignment required? to Yes, then add the people or groups who may use it under Users and groups.
• The Sumnote app: in the Microsoft Teams admin center, under Teams apps → Manage apps, choose who the app is available to, or block it.
• Auto-record in Teams: your Microsoft Teams meeting policies decide whether meetings may record themselves at all (see What you approve).

You can withdraw Sumnote’s access at any time.

• Revoke its permissions: in the Microsoft Entra admin center, open Enterprise apps → Sumnote → Permissions and revoke them (the same for Sumnote Conversation Reader, if you approved it). Revoking alone doesn’t stop people from approving Sumnote for themselves again; to stop that too, delete Sumnote from Enterprise apps, or set it so only assigned people can use it (Choose who can use it).
• Block the Sumnote app: in the Microsoft Teams admin center, under Teams apps → Manage apps, select Sumnote and block it, or remove it from a team or a chat.
• One person: they can disconnect it in Sumnote, and revoke the permissions they gave it themselves at myapps.microsoft.com.

Once Sumnote’s access is gone, it stops reading people’s OneDrive and calendars as soon as its current Microsoft access runs out, within about an hour, and their Microsoft card in Sumnote asks them to reconnect. If you allow Sumnote again later, people’s connections can come back by themselves within a few hours.

• Sumnote transcribes recordings itself, with its speech-to-text providers, and doesn’t use the transcripts Microsoft Teams makes. Its transcripts are treated like any recording made in Sumnote, including each person’s choice about helping train Sumnote’s own models.
• Nothing Microsoft wrote is used for training: not meeting subjects, Outlook events, messages from Microsoft Teams, or tasks added there.
• Voice identification is opt-in: it needs the workspace’s Voice recognition on and each person’s own consent.
• Microsoft’s access tokens are stored encrypted. Data is encrypted in transit and at rest, and is hosted in the United States. Sumnote never sells personal information.

The full details are in our Privacy Policy, Terms of Use, and Sub-processors. For a question, to report a security concern, or to report content the Sumnote app produced that is wrong, harmful, or offensive, email support@sumnote.com or privacy@sumnote.com.