# For IT administrators

> How a Google Workspace or Microsoft 365 administrator allows the sign-in StellarFirm uses for Drive, OneDrive, SharePoint, mail, and calendars, and removes it.

People connect Google Drive, OneDrive, SharePoint, Gmail, Outlook, and Google Calendar to StellarFirm with their own Google or Microsoft sign-in, made through **Composio**, the service StellarFirm connects apps with. Google's and Microsoft's permission screens therefore show **Composio's app**, and Composio keeps the sign-in. Many organizations decide which apps may use that sign-in. This page is for the administrator who makes that call: what StellarFirm does with the access, and the steps to allow it, limit it, and remove it.

## What StellarFirm does with the access

- **Reads** the files the signed-in person can already open, when they ask about their files in chat.
- **Saves a new file or folder** into a folder the person picks, only after the person approves it on the Approvals screen. There is no setting that saves without asking.
- **Never** changes, renames, moves, copies, shares, or deletes a file that is already there, and never changes a site, a folder's sharing, or anyone's permissions. StellarFirm refuses those requests itself, before anything reaches Google or Microsoft, whatever the sign-in would allow. A new file never replaces one already there.
- Sees nothing the person cannot see. Every call runs as that person, so your sharing settings, labels, and policies apply.
- Never holds the Google or Microsoft sign-in itself: Composio keeps it. A person removes it at Google or Microsoft at any time (below).

The permissions Google and Microsoft show are Composio's, and they read broader than this, because Google and Microsoft offer no narrower permission that lets an app save into a folder a person already has. Mail and calendars are separate sign-ins with their own permissions, and anything StellarFirm would send or invite people to there waits for the person's Approve.

People who connected before StellarFirm used Composio may still have a sign-in with **StellarFirm's** own app. It is allowed, limited, and removed the same way: search for StellarFirm instead of Composio in the steps below.

## Google Workspace

### Allow it

1. Sign in to the [Google Admin console](https://admin.google.com) as a super administrator, or an administrator with the security settings privilege.
2. Go to **Security**, then **Access and data control**, then **API controls**.
3. Under **App access control**, click **Manage Third-Party App Access**.
4. Click **Configure new app** and search for **Composio**. If it does not show, search by the OAuth client ID that **Reporting**, **Audit and investigation**, **OAuth log events** lists after a person tried to connect, or ask StellarFirm support for it.
5. Choose who it applies to: everyone, or one organizational unit or group.
6. Choose **Trusted**. **Limited** also works, but only while Drive is not set to Restricted (below).
7. Click **Finish**, then ask people to sign in again from the Google Drive page in StellarFirm.

### If Drive is restricted for third-party apps

Under **API controls**, **Manage Google Services**, a Drive set to **Restricted** lets only Trusted apps use it. Marking Composio as Trusted (step 6) is enough; you do not need to open Drive to every app. A Limited app cannot use a restricted service.

If **Unconfigured third-party apps** is set to block all apps, people see that the app is blocked until you configure it as above.

### Limit or remove it

- To let only some people use it, configure Composio for that organizational unit or group only, and leave it unconfigured or **Blocked** for the rest.
- To remove it for everyone, set Composio to **Blocked** under **Manage Third-Party App Access**. Every sign-in through it stops working at once, for StellarFirm and for any other product that connects through Composio.
- A person can remove it themselves under their Google Account, **Security**, **Your connections to third-party apps and services**.
- **OAuth log events** shows who allowed it and when. Files StellarFirm saves show in the Drive log as created by the person who approved them.

## Microsoft Entra ID

### What people see

Microsoft shows Composio's app and the delegated permissions its OneDrive, SharePoint, or Outlook sign-in asks for. They are delegated permissions: the app acts as the signed-in person, never with its own access to your tenant.

### Why people see "Need admin approval"

Your tenant decides whether people may approve apps themselves, under **Microsoft Entra admin center**, **Identity**, **Applications**, **Enterprise applications**, **Consent and permissions**, **User consent settings**:

| Setting | What people see |
| --- | --- |
| Do not allow user consent | Need admin approval, every time |
| Allow user consent for apps from verified publishers, for selected permissions | Need admin approval when a permission is not in the allowed list. Files and site permissions are rarely in it |
| Allow user consent for apps | They can accept themselves |

### Allow it for your organization

Pick one. Each needs a Global Administrator, Privileged Role Administrator, Cloud Application Administrator, or Application Administrator.

- **Sign in once yourself.** Connect OneDrive or SharePoint in StellarFirm with your administrator account. On Microsoft's permission screen, tick **Consent on behalf of your organization**, then **Accept**.
- **Use the admin consent link.** Ask StellarFirm support for the application ID of Composio's app, then open `https://login.microsoftonline.com/<your tenant ID>/adminconsent?client_id=<application ID>` and accept.
- **Grant it in Entra.** Once Composio's app appears under **Enterprise applications**, open it, then **Permissions**, then **Grant admin consent for** your organization.

Then ask people to sign in again from the OneDrive or SharePoint page in StellarFirm.

### Let people ask you instead

Under **Enterprise applications**, **Consent and permissions**, **Admin consent settings**, turn on **Users can request admin consent to apps they are unable to consent to** and pick who reviews the requests. People then send a request from the **Need admin approval** screen, and it waits for you under **Enterprise applications**, **Admin consent requests**.

### Limit or remove it

- To let only some people use it, open Composio's app under **Enterprise applications**, then **Properties**, set **Assignment required** to **Yes**, and add those people or groups under **Users and groups**.
- Conditional Access policies apply to these sign-ins like any other app.
- To stop it for everyone, set **Enabled for users to sign in** to **No** under its **Properties**, or delete it from **Enterprise applications**. Every sign-in through it stops working, for StellarFirm and for any other product that connects through Composio.
- A person can remove it themselves at **myapps.microsoft.com**.
- The Entra sign-in logs list each sign-in. Files StellarFirm saves show in the Microsoft 365 audit log as uploaded by the person who approved them.

## Questions people ask

**Can StellarFirm read mailboxes, chats, or calendars with the file sign-in?** No. Gmail, Outlook, and Google Calendar are separate sign-ins with their own permissions, which a person connects only when they want them.

**Does every person need to connect?** Each StellarFirm account connects its own Google or Microsoft account. Assistants then see what that one account can see.

**Can an assistant save without asking?** Yes, a new file in a folder the person picked, because they asked for it. It never replaces, moves, shares, or deletes a file, and there is no switch that lets it. See [Approvals and control](/docs/trust/approvals-and-control).

---

Source: https://stellarfirm.ai/docs/trust/it-administrators