Enterprise setup
Last updated · June 2026This guide is for the IT / identity team rolling Breez out to a firm. It covers the four ways your people connect: Google Workspace email, Zoho email, Slack, and Microsoft Teams. Most steps take an admin minutes per channel; nothing here requires you to run servers.
How Breez connects — the model
Everything below follows the same three rules, by design. Read them once and the rest is detail.
- Per-user and delegated. Breez never holds domain-wide or application-level access to your tenant. Each employee individually grants access to their own mailbox and calendar; Breez acts only as that consenting person, only on their data.
- Read-first, writes are earned. Read access is the default. Every outbound action — send a reply, chase a document, create or RSVP an event — is previewed and approved in chat before it happens. Breez never sends autonomously until a person explicitly grants “always allow” for one action type.
- Data stays in India. The Breez SaaS runs in Google Cloud
asia-south1(Mumbai), aligned with the DPDP Act. A dedicated-VPC deployment in your own cloud is available for regulated workloads.
Anything marked you provide → we wire is a value you send us over a secure channel (email hello@aifoundryventures.com); we configure it on the Breez side and confirm. Until a channel’s values are set, that channel stays inert — there is no half-configured state that can leak or misfire.
Google Workspace email
Google mailboxes connect by per-user OAuth, not domain-wide delegation. Each employee taps Connect Google in their Breez chat, signs in, consents, and confirms once in chat — from then on Breez can read their inbox and read/write their calendar, with every send and event staged behind Approve.
Breez requests exactly these delegated scopes and nothing more:
| Scope | What it’s for |
|---|---|
gmail.readonly | Read the inbox — the catch-up scan and ongoing triage. |
gmail.send | Send/reply — only after an in-chat Approve. |
calendar.readonly · calendar.events | Read the calendar; create events and RSVP — only after Approve. |
drive.readonly | Read a document a user points Breez at (no write). |
openid · email | Identify the account for the “confirm this connection” prompt. |
The admin’s one task: trust the app
If your Workspace restricts third-party app access (most do), employees will hit an “unverified app” or “access blocked” screen until you allow the Breez OAuth client. In the Google Admin console:
- Go to Security → Access and data control → API controls → App access control → Manage third-party app access.
- Configure new app → Search by OAuth client ID and paste the Breez client ID (you provide → we wire — we send it to you).
- Set its access to Trusted, scoped to your pilot OU or org-wide. Employees can now connect cleanly.
Connections are revocable any time — by the employee, or by you in the Admin console (Security → API controls). Offboarding a user in Workspace removes their access.
Zoho email
Zoho is supported today as a shared firm inbox over IMAP/SMTP — for example a support@yourfirm.com or orders@yourfirm.commailbox that Breez reads and replies from on the firm’s behalf. Zoho uses an app-specific password, not the account password.
| You provide → we wire | Where it comes from |
|---|---|
support_mailbox_provider = "zoho" | Tells Breez to use the Zoho IMAP/SMTP path. |
support_mailbox_address | The shared mailbox address, e.g. support@yourfirm.com. |
support_mailbox_password | A Zoho app-specific password for that mailbox (Zoho → My Account → Security → App passwords). Never the login password. |
imap.zoho.in / smtp.zoho.in | Default hosts. We override only if your Zoho region differs (e.g. .com). |
Per-user Zoho mailboxes are not yet supported.Zoho doesn’t offer the delegated OAuth that Google and Microsoft do, so an individual employee cannot connect their personal Zoho inbox to their own Breez assistant. People on Zoho use the shared firm inbox above, or connect a Google/Microsoft mailbox if they have one. Per-user Zoho is on the roadmap.
Slack
Slack is the lightest channel to set up: Breez is a published multi-workspace app, so you do not register or host anything. A Workspace Owner or Admin simply installs it.
- Click Add to Slack(we send you the link, or use the button on getbreez.in). You’ll see Slack’s standard install screen with the scopes below.
- Approve. Slack issues a per-workspace bot token, which Breez captures automatically — no token to copy, no webhook URL to configure on your side.
- Optional: in Slack admin → Manage apps, pre-approve “Breez” so members can self-install without an admin request each time.
The app asks for a deliberately minimal, review-friendly set of scopes:
| Scope | What it’s for |
|---|---|
chat:write | Reply to the people who message Breez. |
im:history · im:read · im:write | Hold a direct-message conversation with each user. |
app_mentions:read | See when someone @-mentions Breez in a channel. |
files:read · files:write | Receive a forwarded document; return a file when asked. |
users:read | Map a Slack user to the right person for governance. |
Each person is identified per workspace (team_id:user_id), so two firms on Slack are fully isolated. Removing a member from the workspace removes their access.
Microsoft Teams + Microsoft 365
Teams is the most involved channel because it connects two distinct Microsoft objects to your tenant. This is the summary; we provide the full step-by-step IT guide and a pre-built Teams app package on request.
| Object | Microsoft type | Gives employees |
|---|---|---|
| App A | Entra ID app registration | Connect Outlook mail + calendar (delegated Graph); optional OIDC SSO. |
| App B | Azure Bot (Bot Framework) | Chat with Breez inside Microsoft Teams. |
| Provisioning | Entra Enterprise App → SCIM 2.0 | Auto create/update/disable seats from your directory. |
App A is an Entra app registration with the delegated Graph scopes Mail.Read, Mail.Send, Calendars.ReadWrite, offline_access, openid, email, and the redirect URI https://api.getbreez.in/oauth/microsoft/callback (byte-for-byte). As with Google, access is delegated per employee and every write is staged behind Approve.
App B is an Azure Bot with the messaging endpoint https://api.getbreez.in/webhook/teams and the Teams channel enabled. Your Teams admin then uploads the app package we provide.
SCIM provisioning (recommended) creates, role-maps and disables seats automatically from Entra — an offboarded employee instantly loses access and has their OAuth grants revoked. OIDC SSO(optional) binds an employee’s Teams chat to their directory identity.
You record five values as you go — tenant ID, App A client ID + secret, App B app ID + secret — and send them over the secure channel; we configure and confirm. Request the full Teams + M365 IT guide.
Validate before you roll out
Run this end-to-end with a pilot user before broad rollout (we drive it with you):
- Channel reaches you. Message Breez in Slack or Teams → it replies.
- Connect a mailbox. Tap Connect → sign in → consent → the in-chat confirm shows the right account.
- Catch-up scan. Breez surfaces a real recent item from the connected mailbox or calendar.
- Staged write. Ask it to reply to a mail or create an event → an Approve card appears → approve → confirm it actually happened.
- Offboarding. Remove the pilot user (directory or SCIM) → access is revoked and grants dropped.
What you keep control of
- Action policy: a role × action → allow / confirm / block matrix that sits as a ceiling over the agent.
- Outbound DLP: PAN / Aadhaar / account-number patterns caught on every agent message — redact, block or flag, your choice.
- Append-only audit: every action written before it is taken; export as NDJSON into Splunk or Microsoft Sentinel.
- Right to erasure: DPDP-aligned full purge with a receipt. If employees opt into personal Health/Wealth layers, that data lives in a separate vault no firm admin can read.
Get set up
For the secure value exchange, the pre-built Teams app package, SCIM/OIDC token minting, your Google OAuth client ID, and the validation walkthrough, contact hello@aifoundryventures.com or use the contact form.
← Back to breez