Teams & organisations

Roles, seats, group sync and shared mailboxes for businesses.

A business organisation lets one account manage Sortfully for a whole team: members, seats, shared mailboxes and central policy. You reach it from the Admin Panel item in the sidebar (visible to owners and admins).

Roles

Managing members

Admins can:

• Invite by email. Type one address, or paste a list (up to 100 at a time). An invited person is free until they connect a mailbox. They join with Continue with Microsoft (their work account), then they connect their own work mailbox (the address they were invited with).
• Let people join on their own. Once Microsoft 365 is connected, turn on Anyone in your organisation can join in Add your team: anyone who signs in to Sortfully with a Microsoft account from your organisation joins as a member, no invitation needed. Accounts from other organisations, including guests in yours, can't. You're told who joined, and each person uses a seat once they connect their mailbox. It's off until you turn it on.
• Reminders (on by default): people who haven't signed in, or haven't connected their mailbox, get a reminder about 3 and 7 days after they were invited. Two at most, and they stop as soon as someone is set up. Turn them off with Send reminders.
• Resend or withdraw an invitation that hasn't been accepted. Each link works for 14 days; an expired one is marked so you can resend it.
• Set a role: Member or Admin.
• Remove a member: they revert to a standalone account and can be re-invited later. Their mailbox stops filing unless they have a plan of their own, and they're emailed to say so. Nothing is deleted.
• Transfer ownership (owner only): the new owner takes over billing, and invoices and payment emails go to them from then on; the old owner becomes an admin. The new owner must have signed in to Sortfully first.

Each person in the member list shows where they are: Invited, Not connected, Needs reconnecting, Waiting for a seat, Paused or Filing. You can filter the list by status, or by name or email.

Seats and parking

Seats are pooled across the org. Admins assign or remove a seat per mailbox. A mailbox without a seat is parked: filing pauses for it (nothing is deleted), and the member sees a banner asking their admin for a seat. Filing resumes the moment a seat is assigned.

If someone connects when every seat is taken, their mailbox connects and waits, and every admin gets a notice. When seats are added, or a member is removed, waiting mailboxes get the free seats in the order they started waiting. A mailbox you removed a seat from yourself isn't given one back automatically. The number of seats the org pays for is set by the owner on Billing.

Connecting Microsoft 365 (for IT admins)

Connect Microsoft 365 (in Admin Panel → Sync & settings) asks a Microsoft 365 admin to approve Sortfully for your organisation. Sortfully uses two separate Microsoft apps, kept apart on purpose so neither holds more access than it needs, so Microsoft shows two approval screens one after the other:

What approval 2 means in practice:

• It gives Sortfully no access by itself. The permissions are delegated: Sortfully only works in a mailbox after its owner signs in and connects it, and only within what that person can already open. Nobody is connected automatically.
• People skip Microsoft's permission prompt. Anyone in your organisation can connect without seeing it or asking IT. Many organisations don't let staff approve mail permissions themselves, and then this approval is what lets people connect at all.
• Mail.ReadWrite is broad in Microsoft's terms. Sortfully only reads what it needs to file (sender, folder, time, Outlook categories, Inbox rules read only and, unless switched off, the subject line), never message bodies or attachments, and its build fails if code ever tries to. Microsoft can't enforce that on Sortfully's behalf, so treat it as you would any app with mail access.
• It approves everything listed on the app. Before approving, Microsoft shows the full list; it should be exactly the permissions above.

To keep it tight:

• Limit who can use Sortfully: in Microsoft Entra, Enterprise applications → Sortfully → Properties, set Assignment required to Yes, then assign the group that should use it under Users and groups.
• Review or revoke at any time: Enterprise applications → Sortfully → Permissions. Revoking (or deleting the app there) stops every connection.
• Security tools such as Microsoft Defender may flag an app approved for mail access across an organisation. That's expected for this approval.

You can approve either one on its own instead, and approve the other later.

Microsoft 365 group sync

Admins can connect Microsoft and import users from your tenant's groups, rather than inviting people one at a time. The sync wizard lets you pick groups, preview members, and run the sync. Optional automation can:

• Auto-license newly synced mailboxes,
• Auto-sync hourly, and
• Auto-park leavers when they drop out of every synced group, or their Microsoft account is disabled. A leaver's seat is freed, they lose access to shared mailboxes, and their Sortfully data is deleted after 30 days unless they're added back or given a seat again. This applies to admins too, but never to the owner, and it never changes anyone's role.

Each sync shows how many people were new and how many were already in.

Shared mailboxes

Once directory access is approved, Sortfully finds your shared mailboxes by itself. It lists an account when:

• its sign-in is turned off (Exchange creates shared mailboxes that way), and
• someone who has connected to Sortfully can open it in Outlook.

To check who can open it, Sortfully asks for the mailbox's Inbox folder through each member's own connection. It reads no mail. Everyone who can open it becomes a delegate, and the mailbox appears in their mailbox switcher. Shared mailboxes don't need to be in a synced group. Sortfully checks again every day, after each sync, and when someone connects, and you can run it any time with Check now.

Each mailbox shows why it's listed. Your only decision is which ones to file:

• Give this mailbox a seat, or Give seats to all to seat every one while seats are free.
• With Auto-license on, a shared mailbox with no Microsoft licence gets a free seat by itself.
• One that has a Microsoft licence is marked Check this one. Large shared mailboxes need a licence, but so does a person's, so Sortfully never seats it by itself.
• If something isn't a shared mailbox, open Manage and choose Not a shared mailbox. It won't be listed again. If a person signs in to Sortfully with a mailbox that was listed as shared, it becomes their own mailbox.

A shared mailbox files through one of its delegates, so at least one delegate needs a Sortfully seat of their own. Until then it shows needs a delegate with a seat. You can also add or remove delegates yourself and turn on its detailed activity log under Manage.

If you'd rather take the list straight from Exchange, Advanced: read the list from Exchange instead gives you a short PowerShell command. It reads which mailboxes are shared and who has Full Access, never any mail.

Central policy

Admins can set team-wide defaults:

• Audit detail control: either let members choose their own detailed-log setting, or control it centrally with a default that members can't change.
• Filing delay: set the org-wide default reply-safe delay; members can still override their own within the allowed range. Leave it blank to fall back to the system default.
• Retention window: enforce a single audit retention period for everyone.

Sign-in

Members sign in with Sign in with Microsoft. By default they can also use a passkey or a 6-digit code sent to their email. To require Microsoft sign-in, turn off Sign-in without Microsoft in the Admin Panel. Your organisation's own sign-in rules (such as MFA) then always apply, and someone who leaves can't sign in once their Microsoft account is switched off. Anyone already signed in with a code or a passkey is asked to sign in again with Microsoft.