What your administrator actually does.
Two console steps and a list of mailboxes. No MX change, no mail-flow rule, no connector, no endpoint agent, and nothing for a student to install. Everything below is the real procedure — the same page you get after checkout, with your own values filled in.
The ask, stated plainly
ToneGuard writes the warning into the message, so it needs standing access to the mailboxes you enrol — it reads every message that arrives at them, not only the one somebody happens to be looking at. That is a real grant and this page will not soften it. What bounds it:
- It cannot delete mail. On Google we never request
https://mail.google.com/, so no API in this deployment can permanently delete anything. The strongest action available is to re-deliver a message with the warning on it and move the original out of the inbox, keeping it. - A grant is not a scan. Nothing is read until a mailbox is explicitly enrolled, one at a time. Delegating the scopes and enrolling nobody scans nothing.
- You revoke it, not us. Delete the delegation row or withdraw the app's consent and every mailbox stops on the next token mint. No ticket, no notice period.
- Start in label mode if you prefer. Nothing is modified at all — the warning becomes a label instead of a banner. Weaker warning, zero change to the message.
Google Workspace
LiveGmail publishes each arrival to us; we analyse it and, when it earns a warning, insert the bannered copy and archive the original. Roughly two minutes of console work.
Authorise the scanner for exactly two scopes
In the Google Admin console: Security → Access and data control → API controls → Domain-wide delegation → Add new. Paste the client ID, then the scope list exactly as written — Google matches the set, and a mismatch fails closed with
unauthorized_clientrather than silently working with less.Client IDissued to your institution at checkoutOAuth scopeshttps://www.googleapis.com/auth/gmail.modify,https://www.googleapis.com/auth/gmail.insertDeliberately absent:
https://mail.google.com/. Adding it would give this deployment the ability to permanently delete mail, which is the one thing we have designed ourselves out of being able to do.Name the mailboxes
Enrolment is per mailbox and never implicit. Choose banner mode (the warning is written into the message) or label mode (nothing is modified; the warning is a Gmail label). After checkout this is a form; before it, it is a line we run for you.
Start with the mailboxes an attacker actually aims at — finance, procurement, payroll, the president's office — rather than the whole directory.
Prove it, without waiting for a phishing email
Send an enrolled mailbox a message with a mismatched link, from an account outside your domain. Within about a minute the copy carrying the banner replaces it.
Send from another account. Self-sent mail is skipped by design, so testing from your own mailbox produces nothing and looks like a broken install.
Microsoft 365
LiveMicrosoft Graph notifies us per enrolled mailbox. Because Graph edits a message in place, the banner path copies the original to the archive folder and confirms that copy exists before touching anything — a failed copy means the message is not modified at all.
Consent the application into your directory
An Entra ID global administrator grants Microsoft Graph application permissions
Mail.Readand — for banner mode —Mail.ReadWrite. Choosing report mode instead needs onlyMail.Read: the verdict exists in the audit record for your own mail flow to act on, and nothing is ever modified.The application ID and the consent link are issued to your institution at checkout.
Scope the grant to the mailboxes you named
This step is not optional and it is the one most often skipped. A Graph application permission has no per-mailbox subject the way Google's delegation does — consenting
Mail.Readgrants the app every mailbox in your tenant until an Exchange Online application access policy narrows it.Exchange Online PowerShellNew-ApplicationAccessPolicy -AppId <application id> -PolicyScopeGroupId ToneGuard-Protected@yourdomain.edu -AccessRight RestrictAccess -Description "ToneGuard: enrolled mailboxes only"Put the mailboxes you are enrolling into that mail-enabled security group. The policy is enforced by Microsoft, on their side of the call — it does not depend on us behaving.
Name the mailboxes, then test
Enrolment is per mailbox here too, and it performs the first real Graph round-trip — a subscription handshake — so a mailbox that enrols successfully is a mailbox that is genuinely reachable. Unlike Gmail, Outlook scans self-sent mail, so you can test from the mailbox itself.
Outlook caches the rendered body. If the banner does not appear, close the message and reopen it before concluding anything.
What we never ask for
- No permission that deletes mail, on either platform. Originals are archived and kept indefinitely, so our copy and the sender's can always be compared.
- No directory or contact data. No group membership, no org chart, no address book.
- No mail flow. Your MX records, connectors and transport rules are untouched. If ToneGuard is down, mail is delivered exactly as it is today — there is nothing in the path to fail.
- No endpoint agent, and no student action. Nobody signs in to ToneGuard; no ToneGuard credential exists to phish.
- No signed mail is rewritten. A signature is a claim about exact bytes, so S/MIME messages get a label instead of a banner, automatically.
Reviewers can ask for the full data-handling document and the vendor-assessment answers before you buy — write to hello@toneguard.email. The commercial side is on pricing.
Start a pilot