Breez
The work agentFirm editionPricingGet on the list →

Enterprise setup

Last updated · June 2026

This guide is for the IT / identity team rolling Breez out to a firm. It covers the four ways your people connect: Google Workspace email, Zoho email, Slack, and Microsoft Teams. Most steps take an admin minutes per channel; nothing here requires you to run servers.

How Breez connects — the model

Everything below follows the same three rules, by design. Read them once and the rest is detail.

  • Per-user and delegated. Breez never holds domain-wide or application-level access to your tenant. Each employee individually grants access to their own mailbox and calendar; Breez acts only as that consenting person, only on their data.
  • Read-first, writes are earned. Read access is the default. Every outbound action — send a reply, chase a document, create or RSVP an event — is previewed and approved in chat before it happens. Breez never sends autonomously until a person explicitly grants “always allow” for one action type.
  • Data stays in India. The Breez SaaS runs in Google Cloud asia-south1 (Mumbai), aligned with the DPDP Act. A dedicated-VPC deployment in your own cloud is available for regulated workloads.

Anything marked you provide → we wire is a value you send us over a secure channel (email hello@aifoundryventures.com); we configure it on the Breez side and confirm. Until a channel’s values are set, that channel stays inert — there is no half-configured state that can leak or misfire.

Google Workspace email

Google mailboxes connect by per-user OAuth, not domain-wide delegation. Each employee taps Connect Google in their Breez chat, signs in, consents, and confirms once in chat — from then on Breez can read their inbox and read/write their calendar, with every send and event staged behind Approve.

Breez requests exactly these delegated scopes and nothing more:

ScopeWhat it’s for
gmail.readonlyRead the inbox — the catch-up scan and ongoing triage.
gmail.sendSend/reply — only after an in-chat Approve.
calendar.readonly · calendar.eventsRead the calendar; create events and RSVP — only after Approve.
drive.readonlyRead a document a user points Breez at (no write).
openid · emailIdentify the account for the “confirm this connection” prompt.

The admin’s one task: trust the app

If your Workspace restricts third-party app access (most do), employees will hit an “unverified app” or “access blocked” screen until you allow the Breez OAuth client. In the Google Admin console:

  1. Go to Security → Access and data control → API controls → App access control → Manage third-party app access.
  2. Configure new app → Search by OAuth client ID and paste the Breez client ID (you provide → we wire — we send it to you).
  3. Set its access to Trusted, scoped to your pilot OU or org-wide. Employees can now connect cleanly.

Connections are revocable any time — by the employee, or by you in the Admin console (Security → API controls). Offboarding a user in Workspace removes their access.

Zoho email

Zoho is supported today as a shared firm inbox over IMAP/SMTP — for example a support@yourfirm.com or orders@yourfirm.commailbox that Breez reads and replies from on the firm’s behalf. Zoho uses an app-specific password, not the account password.

You provide → we wireWhere it comes from
support_mailbox_provider = "zoho"Tells Breez to use the Zoho IMAP/SMTP path.
support_mailbox_addressThe shared mailbox address, e.g. support@yourfirm.com.
support_mailbox_passwordA Zoho app-specific password for that mailbox (Zoho → My Account → Security → App passwords). Never the login password.
imap.zoho.in / smtp.zoho.inDefault hosts. We override only if your Zoho region differs (e.g. .com).

Per-user Zoho mailboxes are not yet supported.Zoho doesn’t offer the delegated OAuth that Google and Microsoft do, so an individual employee cannot connect their personal Zoho inbox to their own Breez assistant. People on Zoho use the shared firm inbox above, or connect a Google/Microsoft mailbox if they have one. Per-user Zoho is on the roadmap.

Slack

Slack is the lightest channel to set up: Breez is a published multi-workspace app, so you do not register or host anything. A Workspace Owner or Admin simply installs it.

  1. Click Add to Slack(we send you the link, or use the button on getbreez.in). You’ll see Slack’s standard install screen with the scopes below.
  2. Approve. Slack issues a per-workspace bot token, which Breez captures automatically — no token to copy, no webhook URL to configure on your side.
  3. Optional: in Slack admin → Manage apps, pre-approve “Breez” so members can self-install without an admin request each time.

The app asks for a deliberately minimal, review-friendly set of scopes:

ScopeWhat it’s for
chat:writeReply to the people who message Breez.
im:history · im:read · im:writeHold a direct-message conversation with each user.
app_mentions:readSee when someone @-mentions Breez in a channel.
files:read · files:writeReceive a forwarded document; return a file when asked.
users:readMap a Slack user to the right person for governance.

Each person is identified per workspace (team_id:user_id), so two firms on Slack are fully isolated. Removing a member from the workspace removes their access.

Microsoft Teams + Microsoft 365

Teams is the most involved channel because it connects two distinct Microsoft objects to your tenant. This is the summary; we provide the full step-by-step IT guide and a pre-built Teams app package on request.

ObjectMicrosoft typeGives employees
App AEntra ID app registrationConnect Outlook mail + calendar (delegated Graph); optional OIDC SSO.
App BAzure Bot (Bot Framework)Chat with Breez inside Microsoft Teams.
ProvisioningEntra Enterprise App → SCIM 2.0Auto create/update/disable seats from your directory.

App A is an Entra app registration with the delegated Graph scopes Mail.Read, Mail.Send, Calendars.ReadWrite, offline_access, openid, email, and the redirect URI https://api.getbreez.in/oauth/microsoft/callback (byte-for-byte). As with Google, access is delegated per employee and every write is staged behind Approve.

App B is an Azure Bot with the messaging endpoint https://api.getbreez.in/webhook/teams and the Teams channel enabled. Your Teams admin then uploads the app package we provide.

SCIM provisioning (recommended) creates, role-maps and disables seats automatically from Entra — an offboarded employee instantly loses access and has their OAuth grants revoked. OIDC SSO(optional) binds an employee’s Teams chat to their directory identity.

You record five values as you go — tenant ID, App A client ID + secret, App B app ID + secret — and send them over the secure channel; we configure and confirm. Request the full Teams + M365 IT guide.

Validate before you roll out

Run this end-to-end with a pilot user before broad rollout (we drive it with you):

  1. Channel reaches you. Message Breez in Slack or Teams → it replies.
  2. Connect a mailbox. Tap Connect → sign in → consent → the in-chat confirm shows the right account.
  3. Catch-up scan. Breez surfaces a real recent item from the connected mailbox or calendar.
  4. Staged write. Ask it to reply to a mail or create an event → an Approve card appears → approve → confirm it actually happened.
  5. Offboarding. Remove the pilot user (directory or SCIM) → access is revoked and grants dropped.

What you keep control of

  • Action policy: a role × action → allow / confirm / block matrix that sits as a ceiling over the agent.
  • Outbound DLP: PAN / Aadhaar / account-number patterns caught on every agent message — redact, block or flag, your choice.
  • Append-only audit: every action written before it is taken; export as NDJSON into Splunk or Microsoft Sentinel.
  • Right to erasure: DPDP-aligned full purge with a receipt. If employees opt into personal Health/Wealth layers, that data lives in a separate vault no firm admin can read.

Get set up

For the secure value exchange, the pre-built Teams app package, SCIM/OIDC token minting, your Google OAuth client ID, and the validation walkthrough, contact hello@aifoundryventures.com or use the contact form.

← Back to breez
Breez always on · An AI Foundry Ventures LLP product · Bengaluru, India
DPDP-ready · data residency asia-south1
Pricing · Enterprise setup · Contact · Terms · Refund & Cancellation · Privacy · DPA · Security