Guide for IT admins

Someone in your organization wants to use Fidune, an AI work assistant for iPhone, with their work mailbox, and your tenant needs an administrator to approve it. This page explains what Fidune asks for, why, what BeeLabs never receives, and how to approve it in Microsoft 365 or Google Workspace.

Fidune is a working name and is in beta. Page updated 2026-10-29.

In short

• Fidune is a public client on iPhone. It has no client secret and no BeeLabs server. Each user's iPhone signs in with OAuth (authorization code with PKCE) and calls Microsoft Graph or the Gmail API directly.
• Access tokens and refresh tokens are stored only in that user's iPhone Keychain, on that device only.
• Mail is stored and processed on the user's iPhone. Apple Private Cloud Compute is used only for features the user turns on.
• Fidune requests delegated permissions only: it acts as the signed-in user, on that user's own mailbox. It requests no application permissions and cannot read anyone else's mail.
• Fidune sends mail only after the user approves the exact message.

What BeeLabs never receives

• Mail, attachments, calendar data or anything derived from them
• Access tokens, refresh tokens or passwords
• Lists of your users or your directory

BeeLabs runs no backend in the content or token path. The only data BeeLabs can receive from the app is an anonymous statistics export that a beta tester previews and chooses to share. Details are in the privacy policy.

Microsoft 365

Why your users see "Need admin approval"

Microsoft's default user consent policy for tenants ("Let Microsoft manage your consent settings") does not let users consent on their own to third-party apps that read mail or calendars, such as Mail.ReadWrite and Calendars.ReadWrite. An administrator must approve the app once for the tenant.

What Fidune requests (delegated Microsoft Graph permissions)

All five are declared on Fidune's app registration. Tenant-wide admin consent through the link below approves the permissions declared on the registration, so it covers Mail.Send and Calendars.ReadWrite as well, even though the app asks each user for them only when they turn the feature on.

Approve Fidune for your tenant

Sign in as a user with a role that can grant tenant-wide consent for delegated permissions, such as Cloud Application Administrator, Application Administrator or Privileged Role Administrator, and open:

https://login.microsoftonline.com/{tenant}/adminconsent?client_id=c64d8ac7-2f27-4fd6-9332-80f5bcdeaea8

Replace {tenant} with your tenant ID or one of your verified domain names (for example contoso.com). Microsoft shows the permissions above; review them and select Accept. Users can then connect Fidune without a further prompt from you.

Alternatively, after one user has tried to sign in, Fidune appears in the Microsoft Entra admin center under Enterprise apps; open it, select Permissions and choose Grant admin consent. To limit Fidune to named users, set "Assignment required" on the enterprise app and assign those users or groups.

See Microsoft's instructions: Grant tenant-wide admin consent to an application.

Publisher verification

BeeLabs is completing Microsoft publisher verification for Fidune. Until it is complete, tenants that use risk-based step-up consent may block users from consenting to the app; tenant-wide admin consent above still works.

Removing Fidune

In the Microsoft Entra admin center, open Enterprise apps, select Fidune and delete it or revoke its permissions. Each user can also see Fidune at myapps.microsoft.com. Revoking consent stops new access; the refresh token on the user's iPhone then fails and Fidune asks the user to reconnect.

Conditional Access: not supported in the beta

If your tenant uses Conditional Access policies that require an approved client app or an app protection policy (Intune), or that require a compliant or managed device, Fidune may be blocked even after admin consent. Fidune is not an approved client app and does not include the Intune SDK. These tenants are not supported in the beta.

Google Workspace

Why your users see an "admin_policy_enforced" or blocked-app error

Your Workspace administrator controls which third-party apps can use Google data, under API controls in the Admin console. If third-party access is restricted, users cannot connect Fidune until you allow it.

What Fidune requests (Google OAuth scopes)

Fidune does not request gmail.modify or full mail access. Google Calendar scopes will be added here before the app requests them.

Allow Fidune in the Admin console

1. In the Google Admin console, go to Menu > Security > Access and data control > API controls. You need the Service Settings administrator privilege.
2. Select Manage App Access, then under Configured apps select Configure new app.
3. Search by Fidune's OAuth client ID, 516156988706-r18rp3anlnfjhehk6f6e0347r51ltmnn.apps.googleusercontent.com, and select the iOS app in the results.
4. For Scope, keep the top organizational unit to allow everyone, or select only the organizational units that should have access. Select Continue.
5. For Access to Google data, choose Specific Google data and include the scopes listed above (including the sign-in scopes), or choose Trusted. Do not choose Limited: Limited allows only unrestricted services, and gmail.readonly is restricted.
6. Review and select Change access. Users in those organizational units can then connect Fidune.

See Google's instructions: Control which apps access Google Workspace data.

Unverified-app notice

Until Google completes verification of Fidune's Gmail access, users may see Google's "Google hasn't verified this app" screen. The beta is limited by Google to 100 users in total.

Removing Fidune

Set Fidune to Blocked under API controls > Manage App Access. Users can also remove it from their Google Account under third-party connections.

Questions

Email support@fidune.ai. Please do not send mailbox contents, tokens or screenshots that show mail.