This article was last updated on 7th August 2026
Introduction
This article describes how WorkPoint Mail Assistant processes email data within a customer's Microsoft 365 environment. It explains the permissions and access controls used to retrieve and evaluate mailbox content, the communication flows between Exchange Online and the WorkPoint 365 SaaS infrastructure, and the limited diagnostic and cache data retained to support secure and efficient operation of the service. Particular focus is given to data handling, storage, and the controls implemented to ensure customer data remains protected throughout the processing lifecycle.
Mail Assistant Architecture
To understand how Mail Assistant processes customer data, it is important to first understand the communication and data flows between the customer's Microsoft 365 tenant and the WorkPoint 365 SaaS infrastructure.
WorkPoint Mail Assistant provides rules-based processing of messages received in Exchange Online mailboxes. To enable this functionality, customers grant the permissions required for Mail Assistant to access mailbox data through Microsoft Graph. Retrieved messages are then evaluated and processed according to the rules configured within the WorkPoint solution.
While core WorkPoint services operate using the SharePoint Online permissions granted during solution installation, Mail Assistant requires additional Exchange Online permissions to access mailbox content and process messages that meet the configured criteria.
Mail Assistant supports multiple authentication and access models, allowing customers to choose the approach that best aligns with their security requirements and operational needs. These options are described in detail in the Mail Assistant installation and configuration documentation.
To illustrate the communication flow the architecture and communication diagram below shows the recommended Role-Based Access model, which follows a least-privilege security approach. Although Mail Assistant also supports alternative access models, including dedicated service accounts and application-based permissions, the role-based model provides the clearest and most controlled security boundary. For this reason, it is used throughout this article to demonstrate how Mail Assistant authenticates, accesses mailbox data, and transfers approved content between Exchange Online and the WorkPoint solution. Regardless of the access model used, the message processing and data flows remain materially the same.
In this configuration, a dedicated Mail Assistant identity (A) is assigned an Exchange Management Scope (B). The management scope uses a "Member Of" recipient filter to restrict access to mailbox profiles belonging to members of a designated Microsoft Entra ID group (C). This configuration limits Mail Assistant to the Mail and MailboxSettings permissions required to process messages within the approved mailbox scope. Mail Assistant has no access to mailboxes outside of this scope.
A key design principle of Mail Assistant is to give customers full control over how and where their message data is processed and stored. In the following sections we will describe the primary request flows between the customer's Microsoft 365 tenant and the WorkPoint 365 SaaS infrastructure, and identify the limited data that is persisted outside the customer's tenant boundary to support message processing and operational reliability.
Data Processing
In this section, we describe the interactions that occur at each stage of the Mail Assistant processing flow. For each stage, the data exchanged between the customer's Microsoft 365 tenant and the WorkPoint 365 SaaS infrastructure is identified, together with details of any data persisted within WorkPoint infrastructure to support diagnostics, auditing, and processing efficiency.
As a general principle, no customer business data, email content, or personally identifiable information (PII) is persisted during message processing. Subsequent sections provide representative examples of the diagnostic telemetry and cache data retained by Mail Assistant, providing transparency into the limited data stored outside the customer's tenant boundary and the purpose for which it is retained.
From the architecture / communication diagram (above), the following steps clarify the processing logic and data exchange between Customer and WorkPoint365 tenants to facilitate Mail Assistant message processing.
1. Initiate
Mail Assistant is triggered either on a scheduled interval (scan mode) -or- triggered via WebHook originating from events in registered Mailboxes. This initiates the scan for messages to be processed.
2. Query Mailboxes
Mail Assistant uses the cache database (D) to track the timestamp of the last successful execution. This enables incremental message retrieval and prevents duplicate processing of messages that have already been handled.
Data Handling: The cache database stores mailbox UPNs and execution state information, including the timestamp of the last successful run.
In retrieving message data via Graph request, message metadata (message id, subject, date, sender, body etc) is retrieved from the /messages graph endpoint for analysis and filtering. This data is processed transiently in the context of the process running on the function app execution host of WorkPoint SaaS infrastructure. This data is not persisted within WorkPoint SaaS infrastructure, though telemetry and diagnostic data (E) recorded in Application Insights for monitoring and troubleshooting purposes (see examples in the section below).
3. Apply Rules and Filters
Retrieved messages are first evaluated against the Cache Database (D) to determine if they have been previously processed and, if so, logged (E) and discarded.
Remaining messages are then filtered by the Mail Assistant rule configuration to determine whether they should be processed or ignored. Messages that explicitly match an exclude rule, or fail to match an include rule, are excluded from further processing. Only messages that satisfy the configured rule set proceed to the next stage of processing.
Data Handling: Message processing occurs within the execution context of the current job. Email content, subjects, and attachments are not persisted in WorkPoint SaaS infrastructure. The cache database stores only the internetMessageId of processed messages (see example below), allowing Mail Assistant to efficiently skip messages that have already been handled.
4. Entity Matching
For each message that matches the configured rules, Mail Assistant applies the Entity Matching rules to identify the WorkPoint Entity that will receive the Message. The matching process can use metadata, identifiers, email addresses, reference numbers, or other business-specific criteria as described in the main support article.
When one or more matching entities are identified, Mail Assistant creates a process launch context that includes the message identifier and target WorkPoint entity.
5. Launch Automate Process
When a valid processing context has been established, Mail Assistant initiates the configured WorkPoint Automate process.
The process context, message metadata, and matching details are passed to WorkPoint Automate. WorkPoint Automate then continues the customer-defined workflow, such as classifying the email, retrieving attachments, and storing content within the appropriate WorkPoint location. Telemetry data (E) is recorded to capture the Process init event.
6. Process Launch
Mail Assistant delegates the actual processing of Message and Entity contexts to the WorkPoint Automate system. While Customers can define the specific sequence of WorkPoint Automate steps to handle Email processing, typically this includes use of the WorkPoint Automate Step Upload Outlook Emails And Attachments which is used to transfer message content into Document Libraries in WorkPoint Entity Sites. This step includes a request to retrieve the message and (optionally) the attachment content in order to perform the upload. In doing so, this involves the message being processed via WorkPoint SaaS (transiently) to handle this exchange of information. The mail / message data is not persisted in any way on WorkPoint infrastructure.
Examples of Retained Data
In this section we review samples of the data persisted on WorkPoint365 SaaS Infrastructure in the processing steps outlined above.
Cached Data
WorkPoint Mail Assistant Cache Data (D) records message identifiers (internetMessageId) (1) and mailbox upn pairs in the Cosmos Database to allow resource and request efficient skipping of previously processed mail items. This data consists simply of system identifiers such as the example shown below.
Telemetry / Logging
WorkPoint Mail Assistant telemetry (E) records diagnostic and operational events in the Azure Application Insights instance used by the WorkPoint 365 SaaS platform. An example of the telemetry generated by Mail Assistant is shown below. All logged data is intentionally redacted and limited to internal identifiers and processing metadata. This approach to data minimisation and redaction is applied consistently across WorkPoint SaaS services and endpoints to ensure diagnostic capabilities are maintained without exposing customer data.
No Personally Identifiable Information (PII), email content, attachments, or customer business data are captured by the logging framework.
Application Insights data is used by WorkPoint for operational monitoring, diagnostics, and troubleshooting, and is retained for 90 days. Customer-specific telemetry is also made available to authorised customer administrators through the WorkPoint Admin Portal, providing visibility into Mail Assistant processing activities and service operations
An example of the type of telemetry data recorded by Mail Assistant during processing requests is included below. Note the use of mail profile GUIDS (1) and Message Identifiers (2) is system data only devoid of human-readable message content or metadata.
Comments
0 comments
Please sign in to leave a comment.