Mail and calendar
Connect Microsoft 365 or Google Workspace mail and calendar to Workspace: access levels, consent, data use, confirmations, disconnecting and deletion.
What it does
Mail and calendar lets the Workspace assistant work with your own mailbox and calendar in Microsoft 365 (Outlook) or Google Workspace (Gmail and Google Calendar). It acts as you and only within what your organisation allows: it can search and read mail, look up events and free/busy times, write emails as documents, and, if your organisation allows it, create, update and answer calendar events.
Each member can connect several accounts, in any mix of Microsoft 365 and Google Workspace, and only from a Microsoft directory or Google Workspace domain that your organisation has listed. Nothing is connected until you do it yourself. The assistant never sends email: sending is always your own click on an email in Sluis.
Access levels and admin setup
Owners and admins choose two levels in the console, in the Mail and calendar card under Settings. Mail is Off, Read, Read + drafts or Read + drafts + send. Calendar is Off, Read or Read + manage events. Members only ever receive the permissions of the chosen levels. If a level is raised later, members are asked to reconnect so they can grant the new permissions.
Before anyone can connect, list your organisation’s Microsoft Entra directories or Google Workspace domains under Settings › Application security. For Google, list the primary domain. Then complete the provider’s one-time trust step. Microsoft: an Entra administrator approves Sluis once per directory, using the approval link shown in the card. Google: a Google Workspace administrator trusts Sluis once. In the Google Admin console open Security › API controls › App access control, choose Configure new app, search for the client ID shown in the card and set its access to Trusted.
If your organisation’s residency policy rules a provider out, the card says so and members cannot connect that provider.
Connect your account
In Workspace open Settings › Connections. In the Mail and calendar section choose Connect for Microsoft 365 or Google Workspace. Before you are sent to the provider, Workspace shows a notice in the app. It explains which data Sluis will access, how it is used and who receives it, including the AI model providers your organisation has enabled. You must confirm the notice to continue. Closing it cancels the connection.
Then finish signing in in your browser at Microsoft or Google, approve the permissions and return to Workspace. If sign-in is refused, ask your admin whether the provider’s trust step is done and your domain or directory is listed. You can connect more than one account: choose Connect again to add another. With several accounts, searches cover all of them, and anything that changes something (a calendar event, a draft in Outlook or Gmail, a sent email) uses the one you choose, which the confirmation card and the email show. Connecting an account you already connected updates it.
What data is accessed and where it goes
The assistant only reaches what the levels above allow: the messages it searches or reads (sender, recipients, dates, subject and body), the drafts it helps you create, and calendar events (title, time, location, attendees and description) and free/busy times. It uses them only while you work on a task in a chat.
What the assistant reads becomes part of that conversation. It is sent to the AI model your organisation enabled for the chat, after your organisation’s data protection rules have been applied, and only to model providers your residency policy permits. Sluis shares it with no one else, does not sell it, does not use it for advertising and does not use it to train AI models. Sluis’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
The conversation, including the mail and event text it retrieved, is stored encrypted in your chat history until you delete the conversation or your organisation’s retention period removes it. Your sign-in tokens are stored encrypted and used only to call Microsoft or Google on your behalf.
An email can contain text that tries to give the assistant instructions. Retrieved mail is treated as untrusted content, and such text cannot send mail or change your calendar on its own, because those actions need your confirmation, as described next.
Confirmations for drafts and calendar changes
The assistant writes every email as a document in Sluis and does not write to your mailbox itself. A draft in Outlook or Gmail is only created, and an email only sent, when you click on the email in the chat.
Creating, updating or answering a calendar event shows a confirmation card with the details, including any attendees who will be notified. Nothing happens until you confirm, each change is confirmed separately, and calendar changes never run in scheduled agent runs.
Disconnect and revoke access
Open Settings › Connections, choose Disconnect on the account you want to remove and confirm. Your other accounts stay connected. Sluis deletes the stored sign-in tokens right away and asks Microsoft or Google to revoke them. If the provider does not confirm, Workspace tells you, and you can remove the access yourself: for Google under Third-party apps and services in your Google Account security settings, for Microsoft in your account’s app permissions at myapps.microsoft.com. An administrator can also remove the app in the Google Admin console or Microsoft Entra.
Access also ends when your membership ends or when your admin removes your Microsoft directory or Google Workspace domain from the list. Disconnecting stops all future access. It does not delete past conversations.
Delete your data
Mail and calendar text that appeared in a conversation stays with it. Delete the conversation from the chat list with Delete conversation to remove its messages and canvases, including that text. Drafts, sent emails and calendar events that were created in your Microsoft or Google account belong to that account: delete them in Outlook, Gmail or Calendar.
An organisation owner can have all of the organisation’s data erased and can set a retention period for stored content in the console under Data protection. The privacy policy explains how long data is kept and how to make a request.