Skip to main content
The Draftable Clean Outlook add-in cleans attachments without any Microsoft permissions. One optional feature, the send-time check, needs an administrator to approve Draftable’s app, Draftable Clean, in Microsoft Entra ID. This article explains who needs to do this, what the app can access, and how to approve it. What the send-time check does: when a user presses Send in New Outlook for Windows or Outlook on the web, Draftable Clean reads the attachments as your mail server holds them and confirms they are the cleaned files, not the originals. It is a final safety net that stops an uncleaned document leaving if something went wrong earlier in the process.

​
Who needs to do this

You need to approve Draftable Clean if either of these applies to your organization:
  • You are deploying the add-in for the first time. If you deploy from the app package, you are asked to approve the app as part of the deployment. If you deploy from a manifest URL, use the approval link after deploying.
  • Your organization approved the add-in’s permissions before Outlook add-in 1.12.114.0. From 1.12.114.0, the add-in connects to Microsoft 365 through Draftable’s production app, Draftable Clean, instead of the earlier app. Approval of the earlier app does not carry over, so an administrator needs to approve Draftable Clean once. You do not need to remove or redeploy the add-in.
Until Draftable Clean is approved, cleaning works as normal but the send-time check is off. See What happens if you do not approve it.
Users are never asked to approve anything themselves. The add-in does not show users a Microsoft permission prompt, so the send-time check stays off until an administrator approves the app for the whole organization.

​
About the Draftable Clean app

Use the application ID to confirm you are approving the right app, and to find it later under Enterprise applications.

​
What the app can access and why

The approval covers one Microsoft Graph permission and the standard sign-in permissions that come with it. All of them are delegated permissions: the add-in acts only as the signed-in user, and can only reach what that user can already reach in their own mailbox. Microsoft describes Mail.Read as reading the user’s mail because Microsoft offers no narrower permission that can read attachments. Draftable Clean uses it only to check the email being sent and to read your email size limit. It is read-only: the add-in never changes or sends mail through this permission. Cleaning still happens on the user’s own computer. Your documents are not sent to Draftable.

​
Who can approve it

According to Draftable’s approval result page, approving Draftable Clean for your organization requires a Global Administrator or a Privileged Role Administrator in Microsoft Entra ID. The approval applies to everyone in your organization. You only need to do it once.

​
How to approve it

This option works however the add-in was deployed, and does not change your deployment. Use it if your organization already has the add-in.
1

Find your tenant

You need your organization’s Microsoft 365 tenant domain, for example contoso.onmicrosoft.com, or your tenant ID. The tenant ID is shown on the Overview page of Microsoft Entra ID in the Microsoft Entra admin center.
2

Prepare the link

Copy the link below and replace <tenant> with your tenant domain or tenant ID:
For example, for contoso.onmicrosoft.com the link starts https://login.microsoftonline.com/contoso.onmicrosoft.com/v2.0/adminconsent?....
3

Sign in and accept

Open the link in a browser and sign in with an administrator account that can approve apps. Microsoft lists the permissions Draftable Clean is asking for. Check that the app is Draftable Clean, then select Accept.
4

Check the result

Microsoft returns you to a Draftable page that reports the outcome. Consent granted means the approval worked, and nothing further is needed. Users do not need to sign in again.If the page says Consent was not granted or Consent was not completed, it shows the reason Microsoft gave. Cleaning keeps working in the meantime. You can try the same link again at any time.

​
Option 2: approve in the Microsoft 365 admin center

When you deploy the add-in from its app package in the Microsoft 365 admin center, under Settings > Integrated apps, you are asked to review and accept the add-in’s permissions as part of the deployment. Accepting them approves Draftable Clean. See Installing Draftable Clean Outlook Add-in for the deployment steps.
Your tenant keeps its own copy of an uploaded app package. If your organization uploaded the app package before Outlook add-in 1.12.114.0, that copy still refers to the earlier app, so approving permissions from it does not approve Draftable Clean. Use Option 1 instead, or update the add-in under Integrated apps with the current app package from the Draftable Office Deployment Guide and accept the permissions.A manifest URL deployment never asks for these permissions. Use Option 1.

​
How to check it worked

1
Open Outlook on the web or New Outlook for Windows and start a new email.
2
Add an attachment and let the Draftable Clean pane finish cleaning it, then close and reopen the pane.
3
Hover over the version line at the bottom of the pane. Graph ok means the add-in signed in to Microsoft 365 and read the email’s attachments successfully, so the send-time check is running.
If the line shows Graph off followed by a reason in brackets, the check is not running. Graph off (token) usually means Draftable Clean has not been approved yet. See Troubleshooting: Outlook Add-in for other causes. In Classic Outlook, once Draftable Clean is approved, the line shows Server check: not available in Classic. Before approval it shows Graph off (token), as in the other versions of Outlook. Server check: not available in Classic is expected: the send-time check is not used in Classic Outlook, because Classic Outlook saves drafts on the user’s computer and syncs them to the mail server with a delay. Use Outlook on the web or New Outlook for Windows to confirm the approval.

​
What happens if you do not approve it

The add-in keeps working without the approval:
  • Cleaning works as normal in every supported version of Outlook, and Send Protection still applies.
  • The send-time check is off. The version line at the bottom of the pane shows Graph off (token).
  • New Outlook for Windows and Outlook on the web users confirm each send that has cleaned attachments, with the message “Send-time verification isn’t enabled for this account, so Draftable Clean can’t confirm this email’s attachments before it’s sent.”
  • The add-in uses a standard default email size limit instead of your organization’s own limit.
  • Classic Outlook is not affected. It does not use the send-time check, so Classic users see no extra prompts.

​
Removing the approval

To withdraw the approval, open the Microsoft Entra admin center, go to Enterprise applications, find Draftable Clean (application ID a661f67c-f640-4e9c-8137-2ac9a32589d4) and remove its permissions, or delete the app from your tenant. Cleaning continues to work afterwards, and the add-in behaves as described in What happens if you do not approve it.