Note: This article is intended for organization admins and IT owners. If you are an individual user reconnecting your account after your organization has already enabled enhanced permissions, see How to Reauthenticate Your Email. |
Why Enhanced Permissions Exist
By default, SeekOut Outreach uses a basic mail permission that lets SeekOut read message metadata (subject, sender, headers, timestamps) and send mail on your behalf. Message body content cannot be read with basic permissions.
The basic permission has limits:
Bounces that arrive as separate emails (outside the original thread) cannot be tied back to the campaign that sent them. The linking detail is in the email body.
Out-of-office auto-replies cannot be reliably distinguished from real candidate replies.
Reply content cannot be analyzed to surface candidate intent.
Enhanced mail permissions extend the scope to include message body for inbound mail, addressing these gaps for your Outreach campaigns.
What SeekOut Accesses with Enhanced Permissions
With enhanced permissions, SeekOut reads body content for inbound replies and bounce notifications received in connected mailboxes. The access is scoped to the OAuth permission each user grants and is used to drive Outreach features only.
The data SeekOut stores per connection (subject, from address, timestamps, IP, open events) is unchanged. For the full data inventory by provider, see:
Note: Enabling enhanced permissions does not retroactively grant access. SeekOut only ever holds the scope each individual user has granted on their most recent connection. |
How to Enable Enhanced Permissions for Your Organization
Enhanced permissions are enabled at the organization level and require a brief coordination with SeekOut Support. Follow these steps:
Open the Upgrade your mail permissions banner.
This purple banner appears at the top of any user's Project Outreach tab or Global Outreach Settings. Click Contact support in the banner to open an in-app support chat.
Confirm this is an organization-wide decision.
When chatting with Support, confirm that enabling enhanced permissions has been approved by your organization's admin or IT owner. This change applies to all users in your organization.
Have your IT admin pre-approve the OAuth scope (if required).
Organizations using Azure AD or Google Workspace typically require admin consent before users can grant expanded OAuth permissions. If this applies to your tenant, have your IT admin approve the elevated mail-read scope before users reconnect. SeekOut Support can provide the exact scope name and tenant-consent URL on request.
SeekOut Support enables the setting for your organization.
Support will notify you once enhanced permissions are live for your organization. No further action is required on your end until users begin reconnecting their accounts.
Important: Once enhanced permissions are enabled, all new email connections in your organization will be required to grant the elevated scope. If your IT team has not pre-approved the scope, users will see a tenant-consent error when they attempt to connect. |
What Changes After Enhanced Permissions Are Enabled
Once Support has enabled enhanced permissions for your organization:
New email connections are automatically made with enhanced permissions.
Existing connections remain on basic permissions until each user disconnects and reconnects. Affected users will see an orange Reconnect your account banner and a warning icon (⚠) next to the affected account in Global Outreach Settings.
Rolling back enhanced permissions requires disconnecting all users in the organization and is a manual escalation. Contact Support if you need to revert.
For the user-facing steps to reconnect an existing account under enhanced permissions, see How to Reauthenticate Your Email