AegisAI Perspectives · 082
API-based email security connects in minutes through one admin consent grant, then needs a few days of read-only monitoring before it may remove any mail.
API-based email security connects in minutes, and the first read of each mailbox is paced by API limits of 10,000 requests per 10 minutes1. AegisAI's evaluation needs an admin to approve the API connection, "which takes about five minutes", and a findings review at the end18. The homepage puts the full timeline as "See your results in five days".
The real schedule has three clocks: the consent grant, the first read of each mailbox, and the days of read-only comparison before anything is removed. How the connection works without an MX change is covered in how API-based email security works without an MX record change.
The connection takes minutes, the first read takes hours, and the comparison takes days.
When you grant tenant-wide admin consent, the application gets the requested permissions on behalf of the whole organization4. On Google Workspace, domain-wide delegation lets an application access users' data without each user consenting10.
In Exchange Online, changes to app permissions sit in a cache that varies between 30 minutes and 2 hours8. Plan for that window when you scope or widen access. Test a scoped permission only after the cache window, or the test reads the old grant.
On Microsoft 365, a Privileged Role Administrator can grant consent for any permission on any API6. A Cloud Application Administrator cannot grant Microsoft Graph application permissions. On Google Workspace, domain-wide delegation needs super admin privileges11.
Microsoft calls the grant a sensitive operation and says to review the requested permissions first5. Under an administrative consent workflow, admins review the permissions a new app requests and approve or deny it after a risk assessment14.
In an illicit consent grant attack, a phishing email tricks a user into granting an app access to their data16. The app then has account-level access without an account in the organization. An app granted this way reads data with no account in your directory, so the review reads every permission the app asks for. Book the consent review into day one, not after it.
The first read is paced per mailbox, not per tenant. Microsoft Graph applies its Outlook limits to each app and mailbox pair2. Each pair gets 10,000 requests in 10 minutes and four concurrent requests3. Exceeding the limit on one mailbox does not affect the app's access to another.
A large mailbox therefore takes longer than a small one, and a busy tenant does not slow a quiet mailbox. Ask the vendor how far back the first read goes, and when the last mailbox finishes.
Everything that changes a mailbox stays off until verdicts are checked. NIST defines least privilege as restricting access to the minimum needed for the task15.
Exchange Online can narrow access further. RBAC for Applications pairs an app's grant with a scope that names which mailboxes it can reach7. A role such as Mail.ReadBasic reads email without the body or attachments9. Because Mail.ReadBasic leaves out the body and attachments, it fits a metadata pilot, not a test of verdicts on message content. Use a scope for a pilot group if your review board asks for it. For a full PoC plan, see how to structure a read-only email security PoC.
Before day one, confirm an administrative consent workflow exists.
Day one: an admin with the right role reviews the requested permissions and grants consent.
Day one: note the grant time, and allow up to 2 hours before you test a scoped permission.
Day one to day two: watch the first read finish mailbox by mailbox, paced by the per-mailbox limit.
Days two to four: run in monitoring mode and log each verdict next to your analysts' reading.
Day five: hold the findings review, see your results, and compare them with what your current stack delivered.
After the review: grant write access for removal, and confirm who can revoke it.
| Stage | What happens | What sets the time | Who acts |
|---|---|---|---|
| Consent grant | The app receives organization-wide permissions | One admin approval, after the consent review | Privileged Role Administrator or Google super admin |
| Permission cache | Scoped permission changes take effect | Between 30 minutes and 2 hours | Exchange admin |
| First mailbox read | History is read for each mailbox | 10,000 requests per 10 minutes per mailbox | The vendor's service |
| Read-only comparison | Verdicts are logged, no mail moves | Your review date | Security analysts |
| Enforcement | Removal from mailboxes starts | Write access granted after the review | Admin who can revoke it |
Illustrative example, figures are fictional. Birchline Health Partners (fictional) has 1,200 staff on Microsoft 365. On Monday at 09:00 the identity lead approves the grant through the consent workflow, after reading the permission list. The first read covers 1,180 mailboxes by Tuesday afternoon; the 20 largest finish last. From Tuesday to Friday the platform runs in monitoring mode and logs 41 verdicts. Two analysts agree with 39 and overturn 2, each with a written reason. On Friday the team grants write access for removal, and names the admin who can revoke it.
AegisAI reads mail through the Microsoft 365 or Google Workspace API after delivery, with no change to mail routing20. Its connection is an API connection that takes 5 minutes, and mail routing does not change24. It runs in monitoring mode first, and removal needs write access your admin grants and can revoke. If the service is down, mail keeps flowing and detection pauses until it returns.
Compare those numbers with the timeline on the inbound email security page. See your results in five days: connect a tenant, run AegisAI in monitoring mode, and compare it with what your current stack delivered.
The connection takes minutes, the first read of each mailbox takes hours, and the read-only comparison takes days. AegisAI's evaluation needs about five minutes of admin approval and runs five days before a findings review.
An admin to approve the API connection, which takes about five minutes, and a findings review at the end. Mail flow does not change and nothing is moved or deleted.
No. It reads mail through the Microsoft 365 or Google Workspace API after delivery, so mail routing does not change.
A Privileged Role Administrator can grant consent for any permission on any API. Route the request through an administrative consent workflow so the permissions are reviewed first.
Microsoft Graph limits each app and mailbox pair to 10,000 requests in 10 minutes. Large mailboxes finish last.
After the read-only comparison, when your analysts agree with the verdicts and you know who can revoke the grant.
