Documentation
Every permission Jaha asks for
Jaha is built so your own team can set it up without calling ours. This page lists every permission the product ever asks for and what each one is for. The rule behind all of them: each screen asks only for what that feature needs, read-only wherever reading is enough, and nothing ever asks for the right to delete your records.
Microsoft 365: one admin consent
Everything Jaha does in your Microsoft 365 organization runs on one app registration, granted on a single admin consent screen (Settings → "Grant access in Microsoft 365"). These are application permissions on Microsoft Graph:
| User.Read.All | Directory sync: people, managers, "who's who" and matching assignees. |
| Chat.Read.All | Reading a meeting chat's subject and members so the bot knows which meeting a message belongs to. |
| OnlineMeetings.Read.All | Matching a join link to its meeting, and meeting-start notifications for auto-join. |
| OnlineMeetingTranscript.Read.All | Forwarder mode: reading the transcript Teams itself created. |
| OnlineMeetingArtifact.Read.All | Meeting files and records when the bot is @mentioned into a meeting. |
| Calendars.ReadWrite | Meetings Jaha schedules, reads back or cancels for you. |
| Mail.Read | Context from recent email when a question involves email. |
| Mail.Send | Recap emails, sent from the mailbox you choose. |
| Files.ReadWrite.All | Saving documents to OneDrive when you ask for that. |
| Sites.ReadWrite.All | Storing meeting recordings and audio in your own SharePoint site (see "Recordings in your own Microsoft 365"). |
| Tasks.ReadWrite.All | Creating Planner tasks from action items. |
| Group.Read.All | Listing teams for the channel picker. |
| Channel.ReadBasic.All | Listing channels for the same picker. |
| TeamsAppInstallation.ReadWriteForChat.All | Installing the app in each meeting's chat as the bot joins, so @JahaBot commands work for everyone in the room. |
| AppCatalog.Read.All | Finding the app's own catalog ID, which that installation needs. |
Joining calls
The bot joins meetings as an application-hosted media bot, which uses the Graph Communications permissions:
| Calls.JoinGroupCall.All | Joining a scheduled or live meeting. |
| Calls.AccessMedia.All | Receiving the meeting's audio and video streams. Transcription and recording depend on this. |
| Calls.JoinGroupCallAsGuest.All | Joining meetings where the bot enters as a guest. |
| Calls.Initiate.All | Only needed for dial-out. Otherwise you can leave it ungranted. |
Recordings in your own Microsoft 365
Once Sites.ReadWrite.All is granted, Settings → media destination accepts your SharePoint site URL. Every recording and audio file is then stored in that site, inside your organization, under your own retention policy. Jaha keeps only the details it needs to find and play them. Only media files are stored there.
Connectors: one consent per tool
Each tool you connect has its own OAuth consent screen listing exactly these scopes. Connect only what you use and disconnect any time. The index built from a source is deleted along with it:
| Google Drive (reading) | drive.readonly |
| Google Drive (saving files) | drive.file (only files the app itself creates) |
| Google Calendar | calendar.events.readonly |
| Zoho CRM | ZohoCRM.modules.ALL · ZohoCRM.coql.READ · ZohoCRM.org.READ · ZohoCRM.users.READ |
| Zoho Projects | ZohoProjects.portals.READ · projects.READ · milestones.READ · tasks.READ · bugs.READ · timesheets.READ · tasks.CREATE · bugs.CREATE |
| Zoho CRM module metadata | ZohoCRM.settings.modules.READ · ZohoCRM.settings.fields.READ |
| HubSpot | oauth · crm.objects.{contacts.read/write, companies.read, deals.read, quotes.read, line_items.read, subscriptions.read, owners.read, custom.read} · crm.schemas.{companies, contacts, deals}.read · sales-email-read |
| Salesforce | api · refresh_token · offline_access |
| Pipedrive | scopes are set in the Pipedrive app itself |
| Attio | record_permission:read-write · object_configuration:read · note:read-write · task:read · user_management:read |
| Linear | write |
| Jira | read:jira-work · offline_access |
| Notion | no scope string: access is exactly the pages you share with the integration |
| Slack | search:read (user scope) |
Some tools have no OAuth consent screen, so you connect them by pasting a token in Settings → Connectors: ServiceNow (instance URL plus a service account with the itil role, used both to raise incidents, requests, changes and problems from action items and for an incoming ticket webhook that suggests bridge calls), Asana, ClickUp, monday.com, Todoist, Trello, Dropbox and Box, plus signed Webhook and Zapier destinations. Setup steps are on each connector card and in the connector setup templates.
When you need to reconnect
A consent covers what existed when it was given. When a new feature needs a scope your connection doesn't have, the existing token can't pick it up on its own. Jaha tells you right when it matters ("reconnect the Zoho connector to grant Projects access"), and the fix is always the same: reconnect that one tool with the same sign-in, in one click. Nothing else changes.
The 5-step checklist
1. Install the Teams app from your org catalog. 2. Settings → "Grant access in Microsoft 365". One admin consent covers §1 and §2. 3. If you like, set the SharePoint media destination (§3). 4. Connect the tools you use (§4). 5. If you want auto-join at meeting start, run the access-policy PowerShell. Everything else (transcripts, recording, insights, memory across meetings) needs no more permissions.