Integration options for Google Workspace and Microsoft 365
Ashby integrates with Google Workspace and Microsoft 365 to provide features that enhance hiring speed and efficiency. These integrations increase the risk profile of Ashby as a vendor, but provide significant benefits to your Talent team. Ashby requests access to the emails and calendars of your team members involved in the hiring process and stores a subset of this data to provide a fast and reliable user experience. Our database is encrypted at rest, logically separated by organization, and behind a virtual private cloud (VPC). Ashby encrypts all data transmitted between your IT systems, Ashby's servers, and Ashby's clients in transit. For more information, read our Security Overview.
This article covers the access Ashby requests for each platform integration, the controls in place to protect sensitive data, and the lower privilege configuration options available to your IT or security team. For information on Google Sign-In, Microsoft Sign-In, and Single Sign-On, see Signing in to AshbySigning in to Ashby and SSO and SCIMSSO and SCIM.
Benefits of access (with examples)
This section explains the benefits Ashby provides for the access it requests. Without this access, the functionality described is not available.
Email sync
When Ashby can send email through your email provider (e.g., Gmail), your Talent team and hiring managers can:
- Send emails using predefined templates in Ashby. This creates a consistent candidate experience, from standardizing rejection explanations to how offers are made.
- Send emails on behalf of another user. For instance, this can be used to automatically email a candidate from the hiring manager or recruiter upon moving them to a certain stage.
When Ashby can read emails through your email provider, your Talent team and hiring managers can:
- Send sequences of emails to attract passive candidates. The sequence is paused when the candidate replies; this requires reading the email of the sequence sender. Most Talent teams make a significant percentage of hires from passive candidates.
- Display communication with a candidate on the candidate's profile. This allows a hiring team to coordinate communication (e.g., not repeat things already shared with the candidate, make sure the hiring team reaches out to congratulate the candidate on their offer) and not have to transcribe notes from their email communication (e.g., determine what links or information were already shared with the candidate).
Scheduling
Your Talent team needs to schedule interviews in Ashby to request and capture interviewer feedback.
When Ashby can create calendar events, your Talent team can schedule interviews in Ashby without copying that information to your calendar provider (e.g., Google Calendar).
When Ashby can read the calendars of interviewers and their calendar events, it allows your Talent team to schedule with a more efficient interface manually and even automate scheduling:
- With candidate booking links, candidates can pick an interview time convenient for them based on the availability of potential interviewers. This saves your Talent team the back and forth of requesting availability and cross-referencing it with interviewers' calendars.
- Specific event titles can be considered free or soft conflicts with our scheduling keywords feature. This saves your Talent team from contacting the meeting owner to determine if a meeting can be overbooked. For instance, most organizations consider one-on-ones (e.g., using the keywords "1:1" or "1-1") to be easily reschedulable and consequently a free or soft conflict for scheduling interviews.
- In some cases, your team needs to schedule a candidate manually. Ashby provides a more efficient interface than calendar clients to cross-reference multiple calendars, the candidate's availability, and consider recruiting-specific information like interviewer load.
Ashby can only integrate with one platform integration at a time. See Does Ashby support integrating with both Google and Microsoft at the same time?Does Ashby support integrating with both Google and Microsoft at the same time? for more details.
Select the links below for more information on the platform integration you plan to use.
Integration options for Google Workspace and Microsoft 365Google Workspace Microsoft 365
Google Workspace platform integration
This section details the Google Workspace integration that powers email and calendar sync functionality. It does not include Ashby's Google Sign-In or SSO/SCIM integrations.
See Google WorkspaceGoogle Workspace for more details about setting up the email and scheduling integration.
What does it do?
Ashby integrates with Google Workspace to enable key features like displaying your conversations with candidates in the candidate profile feed and scheduling interviews directly in Ashby.
The integration supports the following:
User | Sync Google Workspace users to automatically provision/de-provision them as Ashby users |
|---|---|
Sync emails between candidates and users (based on inspecting to/from headers) Send emails and email sequences from within Ashby | |
Scheduling | Sync employee calendars Send event invites Sync meeting rooms |
None of these options are required, but all are recommended for the best user experience with Ashby.
What access controls are in place?
Ashby understands that email and calendar data are very sensitive, and puts access controls in place to only show data that is relevant to the hiring process. Ashby also applies a strict permission system where users are granted access to jobs and candidate records on a need-to-know basis (see "Access Control" below).
Default user access is very limited and does not include access to any candidate or job data. Employees cannot view their own candidate profile (their candidate profile must be linked to their employee profile in Ashby to prevent this). Ashby also supports truly confidential jobs that only the creator and those they give access to can see.
Ashby syncs and displays email when relevant to the hiring process. Only emails from Ashby users with an Elevated Access or Organization Admin role are synced by default, since these roles are assigned to employees involved in the hiring process.
All users, including those with Limited Access, can change their email sync preferences in Personal Settings > Email Settings. Turn on Email Sync to enable email sync for your email, or turn it off to disable it.
Replies to a mailbox that is shared with another user via email sharing are always saved to the candidate's profile, regardless of the user's role or email sync setting. More on email sharing at Personal Email Sharing.
From users with Email Sync enabled, Ashby only stores emails sent from Ashby or involving a candidate:
- Emails containing a to, cc, or bcc with the candidate's email and subsequent emails marked by the email provider as being in the email thread.
- Emails sent from Ashby and subsequent emails marked by the email provider as being in the email thread.
- If the candidate's domain matches your organization's auth domain, emails are not synced for that candidate. If the candidate has two email addresses linked to their profile (one with the organization's auth domain and one without), emails including the email address without the organization's auth domain are still synced.
Ashby provides additional controls within the application to:
- Mark emails as private and automatically mark emails during the offer stage as private. Viewing these emails requires an explicit access role in Ashby.
- Hide emails when a candidate moves to offer and hired stages.
- Stop syncing emails related to a candidate after they are hired.
- Stop syncing emails related to a candidate considered for a confidential job.
Calendars
Ashby syncs all accessible calendars and events on those calendars. When visibility controls are enabled on calendars and calendar events, for instance, only showing a specific event as "Free" or "Busy" or marking an event as a private event, Ashby respects such controls and does not display the event details during scheduling.
Ashby supports shared calendars (e.g., "Interviews" calendar). Personal calendars are still used to determine interviewer availability during scheduling.
Recruiting Blocks require event-title visibility. If your organization is on the Enterprise plan or has purchased the Advanced Scheduling Automation Add-OnAdvanced Scheduling Automation add-on, you can use Recruiting Blocks. Ashby must be able to read the event title and time to recognize a Recruiting Block. Private or busy-only visibility can prevent Ashby from identifying the block. See Recruiting Blocks: How They Work and How to Set Them Up for more information.
What are the options for integrating?
Ashby currently supports domain-wide delegation and individual user OAuth. Ashby recommends using domain-wide delegation, but also supports OAuth for email and scheduling. Ashby also offers lower privilege alternatives to these integration options, which you can view below.
Domain-wide delegation
Using domain-wide delegation, all users in your workspace are added to Ashby, and Ashby has the same permissions relative to all users (specifically, their emails and calendars). However, Ashby does not sync email from limited-access users, even if its permissions technically allow it to.
The permissions requested through domain-wide delegation are:
Permission Requested | Google's Description | Required for Feature |
|---|---|---|
Sync users | See info about users on your domain | Automatically adding Google Workspace users to Ashby when Google Workspace user sync is enabled. If SCIM handles user provisioning and deactivation, you can leave Google Workspace user sync disabled, but Ashby still needs this access to retrieve users’ email aliases. Each user must opt in to sync an alias in Personal Settings > Email Settings. |
Sync meetings rooms | View calendar resources on your domain | Add meeting rooms to Ashby scheduling. If turned off, Ashby users cannot see or view meeting room availability when scheduling. |
Read/write shared calendars | See, edit, share, and permanently delete all the calendars you can access using Google Calendar. View and edit events on all your calendars. Shared interview calendars in scheduling. | If turned off, Ashby users cannot see calendars such as shared interview calendars or schedules on shared calendars. |
Read/write personal calendars | See, edit, share, and permanently delete all the calendars you can access using Google Calendar. View and edit events on all your calendars. | Scheduling interviews through Ashby. If turned off, Ashby users cannot see calendars of potential interviewers when scheduling nor schedule on personal calendars. |
Read email | Read all resources and their metadata; no write operations. | Sequences (sourcing) and communications with candidates using a recruiter's email address. If turned off, Ashby users cannot see email correspondence; emails and sequences can only be sent from [email protected]. This is still possible with OAuth but to function properly needs all users corresponding with candidates to OAuth. As an alternative to disabling this, see Limited email sync below. |
Send email | Send messages only. No read or modify privileges on mailbox. | Sequences (sourcing) and communications with candidates through Ashby using a recruiter's email address. If turned off, sequences, offer letters, and one-off email cannot be sent from user emails, only [email protected]. |
Create Google Meet events | Create, edit, and see information about your Google Meet conferences created by the app. | Creating Google Meet meeting links for interview scheduling and people workflows scheduling when Google Meet is selected. |
Read Google Meet spaces | Read information about any of your Google Meet conferences. | Reading existing meeting links that Ashby creates through the Google Calendar API. |
Individual user OAuth
Using OAuth, each user can separately authorize Ashby for a full list of scopes, provided below (in their Personal Settings). It is not possible for a given user to only allow some of the scopes; they can accept all or none.
Here is the full list of requested scopes:
- https://www.googleapis.com/auth/userinfo.profile
- https://www.googleapis.com/auth/userinfo.email
- https://www.googleapis.com/auth/gmail.send
- https://www.googleapis.com/auth/gmail.readonly
- https://www.googleapis.com/auth/calendar
- https://www.googleapis.com/auth/calendar.readonly
- https://www.googleapis.com/auth/calendar.events
- https://www.googleapis.com/auth/meetings.space.created
- https://www.googleapis.com/auth/meetings.space.readonly
Any users without OAuth do not have their candidate communication synced with Ashby, cannot send emails from Ashby, and cannot be automatically scheduled through Ashby.
The permissions available with OAuth are, for a recruiter or member of the hiring team who accepts those scopes:
Permission Requested | Google's Description | Required for Feature |
|---|---|---|
Read/write shared calendars | See, edit, share, and permanently delete all the calendars you can access using Google Calendar. View and edit events on all your calendars. | Shared interview calendars in scheduling. If turned off, Ashby users cannot see calendars such as shared interview calendars nor schedule on shared calendars. |
Read/write personal calendars | See, edit, share, and permanently delete all the calendars you can access using Google Calendar. View and edit events on all your calendars. | Scheduling interviews through Ashby. If turned off, Ashby users cannot see calendars of potential interviewers when scheduling nor schedule on personal calendars. (The interviewer has to also accept this in the case of individual OAuth.) |
Read email | Read all resources and their metadata; no write operations. | Sequences (sourcing) and communications with candidates using a recruiter's email address. If turned off, Ashby users cannot see email correspondence; emails and sequences can only be sent from [email protected]. To function properly, this needs all users corresponding with candidates to OAuth. As an alternative to disabling this, see Limited email sync below. |
Send email | Send messages only. No read or modify privileges on mailbox. | Sequences (sourcing) and communications with candidates through Ashby using a recruiter's email address. If turned off, sequences, offer letters, and one-off email cannot be sent from user emails, only [email protected]. |
Create Google Meet events | Create, edit, and see information about your Google Meet conferences created by the app. | Creating Google Meet meeting links for interview scheduling and people workflows scheduling when Google Meet is selected. |
Read Google Meet spaces | Read information about any of your Google Meet conferences. | Reading existing meeting links that Ashby creates through the Google Calendar API. |
Lower privilege alternatives for Google Workspace
While Ashby recommends the above integration methods, widely adopted even in sensitive industries like finance and health care, we understand that some security teams may have different risk assessments.
To address this, Ashby offers alternatives with more restricted access, though these come with reduced functionality for your Talent team.
For the full permission details of each integration option, see Integration options for Google Workspace and Microsoft 365Integration options for Google Workspace and Microsoft 365.
Limited email sync
For organizations using domain delegation, Ashby offers a "Limited Email Sync" option. This syncs only email metadata, such as recipient, sender, blind carbon copy (BCC), and subject line, while excluding the email body.
As a result:
- Ashby no longer requires the https://www.googleapis.com/auth/gmail.readonly scope. The scope https://www.googleapis.com/auth/gmail.metadata can be used instead.
- Ashby cannot reference email content.
Functionality impact:
- Email sequences continue to work, as Ashby can detect candidate replies.
- However, the Talent team needs to contact users directly to view the email body.
OAuth a separate Google Workspace account for each hiring team member
If you prefer not to provide access to internal employee accounts, you can create dedicated email accounts for hiring team members (e.g., [employee name]@[secondary domain]) under a separate domain within your organization.
Limitations:
- Team members must manage two inboxes: their primary inbox and the separate hiring account.
- Internal calendar access is restricted, impacting Ashby's automated and manual scheduling features.
- Workaround: Calendars can be manually shared with these accounts for partial visibility, but ongoing maintenance is required as new accounts or calendars are added.
Sending emails without email read access
If your organization wants to send emails from Ashby without allowing Ashby to read email contents, authorize these Google scopes:
- https://www.googleapis.com/auth/gmail.send
- https://www.googleapis.com/auth/gmail.settings.basic
The gmail.send scope allows Ashby to send messages. The gmail.settings.basic scope allows Ashby to verify which addresses the Google account can send from. This scope does not grant Ashby access to read email contents.
Do not grant the https://www.googleapis.com/auth/gmail.readonly scope if your organization does not want Ashby to read email contents.
This configuration supports sending email, but does not provide the email-sync functionality that depends on reading email.
OAuth a shared Google Workspace account
Alternatively, you can create a shared email/calendar account (e.g., hiring@[your domain]) for the Talent team to use. This account can be shared in Ashby for sending emails and managing scheduling.
Limitations:
- Candidate experience is compromised:
- Emails do not show the recruiter's name.
- Communication cannot be visually separated by role (e.g., recruiter vs. hiring manager).
- Restricting access to interviewer calendars prevents the use of automated and manual scheduling features.
- Calendars can be shared with the shared account to enable partial visibility.
Microsoft 365 platform integration
This section details the Microsoft 365 integration that powers email and calendar sync functionality. It does not include Ashby's Microsoft Sign-In or SSO/SCIM integrations.
See Microsoft 365Microsoft 365 for more details about setting up the email and scheduling integration.
What does it do?
Ashby integrates with Microsoft 365 to enable key features like displaying your conversations with candidates in the candidate profile feed and scheduling interviews directly in Ashby.
The integration supports the following:
User | Sync Microsoft users to automatically provision/de-provision them as Ashby users. |
|---|---|
* Sync emails between candidates and users (based on inspecting to/from headers) * Send emails and email sequences from within Ashby | |
Scheduling | * Sync employee calendars * Send event invites * Sync meeting rooms |
None of these options are required, but all are recommended for the best user experience with Ashby.
What are the options for integrating?
Microsoft 365 can integrate with Ashby in the following ways. The full documentation on how the integration is set up is available at Microsoft 365Microsoft 365:
- Ashby's managed Azure application (default and recommended for most teams)
- Custom Azure application
Ashby also offers lower privilege alternatives to these integration options, which you can view below.
Custom Azure application
With a custom application, your team can fully configure a custom application and integrate it with Ashby. This option is recommended for teams who want full control over the access granted to Ashby from the outset, and is required if their tenants are hosted in Microsoft's Government Community Cloud (GCC).
See Microsoft Custom Applications (GCC High)Microsoft Custom Applications (GCC High) for more details.
Authorization
Ashby uses a combination of application and delegated permissions to integrate with Microsoft 365. Application permissions allow an admin to grant access to resources on behalf of all users, while delegated permissions require every user to grant access individually.
Application permissions requested
When using Ashby's managed Azure application, Ashby requests the following application permissions.
Permission Requested | Microsoft's Description | Required for Feature |
|---|---|---|
User.Read.All | "Allows the app to read user profiles" | Automatically adding Microsoft 365 users to Ashby when Microsoft 365 user sync is enabled. If SCIM handles user provisioning and deactivation, you can leave Microsoft 365 user sync disabled, but Ashby still needs this permission to retrieve users’ email aliases. Each user must opt in to sync an alias in Personal Settings > Email Settings. Even when user sync is enabled, Ashby syncs only users who have logged in to Ashby at least once. |
Group.ReadWrite.All | "Allows the app to read group properties and memberships, and read conversations for all groups" | Shared interview calendars in scheduling. If turned off, Ashby users cannot see calendars such as shared interview calendars nor schedule on shared calendars. |
MailboxSettings.Read | "Allows the app to read user's mailbox settings. Does not include permission to read [or send] mail." | Employee timezone sync. Allows accurate timezone settings in scheduling. |
Mail.Send | "Allows the app to send mail" | Sequences (sourcing) and communications with candidates using a recruiter's email address. If turned off, sequences, offer letters, and one-off email cannot be sent from user emails, only [email protected]. |
Mail.ReadWrite | "Allows the app to create, read, update, and delete mail. Does not include permission to send mail." | Sequences (sourcing) and communications with candidates using a recruiter's email address. If turned off, Ashby users cannot see email correspondence; emails and sequences can only be sent from [email protected]. To function properly, this needs all users corresponding with candidates to OAuth. As an alternative to disabling this, see Limited email sync below. |
Calendars.ReadWrite | "Allows the app to create, read, update, and delete calendar events." Does not include events on group calendars. | Scheduling interviews through Ashby. If turned off, Ashby users cannot see calendars of potential interviewers when scheduling nor schedule on personal calendars. |
Delegated (OAuth) permissions requested
When users individually authorize Ashby for Microsoft Office 365, Ashby requests delegated versions of the above application scopes, and depending on your intended calendar and video conferencing setup, a few additional scopes that Microsoft does not make available as application scopes.
Permission Requested | Microsoft's Description | Required for Feature |
|---|---|---|
User.Read.All | "Allows the app to read user profiles" | Automatically adding Microsoft 365 users to Ashby when Microsoft 365 user sync is enabled. If SCIM handles user provisioning and deactivation, you can leave Microsoft 365 user sync disabled, but Ashby still needs this permission to retrieve users’ email aliases. Each user must opt in to sync an alias in Personal Settings > Email Settings. Even when user sync is enabled, Ashby syncs only users who have logged in to Ashby at least once. |
MailboxSettings.Read | "Allows the app to read user's mailbox settings. Does not include permission to read [or send] mail." | Employee timezone sync. Allows accurate timezone settings in scheduling. |
Mail.Send | "Allows the app to send mail" | Sequences (sourcing) and communications with candidates using a recruiter's email address. If turned off, sequences, offer letters, and one-off email cannot be sent from user emails, only [email protected]. |
Mail.ReadWrite | "Allows the app to create, read, update, and delete mail. Does not include permission to send mail." | Sequences (sourcing) and communications with candidates using a recruiter's email address. If turned off, Ashby users cannot see email correspondence; emails and sequences can only be sent from [email protected]. To function properly, this needs all users corresponding with candidates to OAuth. As an alternative to disabling this, see Limited email sync below. |
Calendars.ReadWrite | "Allows the app to create, read, update, and delete calendar events." Does not include events on group calendars. | Scheduling interviews through Ashby. If turned off, Ashby users cannot see calendars of potential interviewers when scheduling nor schedule on personal calendars. (The interviewer has to also accept this in the case of individual OAuth.) |
Group.ReadWrite.All | "Also allows the app to read and write calendar, conversations, files, and other group content for all groups the user can access." | Shared interview calendars in scheduling. If turned off, Ashby users cannot schedule on shared calendars. |
OnlineMeetings.ReadWrite | "Allows the app to read and create online meetings on your behalf." | Microsoft Teams video links in meeting invites in scheduling. If using Microsoft Teams meetings with your Microsoft 365 account and this is turned off, Ashby cannot automatically add meeting links to scheduled interviews. |
Details on Microsoft 365 email access and metadata handling
Ashby's Microsoft 365 integration enables organizations to sync user inboxes and calendar data for recruiting workflows such as candidate replies, sourcing sequences, and interview scheduling. This section outlines what data Ashby accesses, how it is processed, and what is stored when using the Microsoft Graph API with Mail.ReadWrite permissions.
Summary of email processing
When a user connects their Microsoft 365 account in Ashby, Ashby registers change notifications (webhooks) for that user's Inbox and Sent Items folders. When a new or updated message is detected, Ashby:
- Fetches the message using Microsoft Graph.
- Evaluates a defined set of metadata fields.
- Determines whether the message is relevant to an active candidate or job application (e.g., by matching the sender or recipient to a known candidate email address).
- If the message is relevant, Ashby retrieves and stores the full email body.
- If not, Ashby discards the message and does not persist it.
Metadata fields accessed
Ashby uses the Microsoft Graph API's $select parameter to restrict the fields it accesses when evaluating a message. These fields include:
- bccRecipients
- ccRecipients
- conversationId
- conversationIndex
- from
- id
- internetMessageHeaders
- internetMessageId
- isDraft
- receivedDateTime
- replyTo
- sender
- sentDateTime
- subject
- toRecipients
Ashby uses these fields exclusively to determine whether the email should be associated with an active candidate record.
Data that is stored
Ashby only stores the full content of an email if it determines the email is related to a candidate or sourcing activity. Otherwise, Ashby evaluates the email in memory and discards it.
This selective access pattern ensures that Ashby only persists recruiting-relevant communications while operating within the broader constraints of Microsoft's Graph API (which does not offer more granular email scopes like Google's .metadata).
Access scope
Ashby uses the Mail.ReadWrite permission scope as required by Microsoft to access messages. This permission enables reading, writing, updating, and deleting emails; however, Ashby only uses it to read and associate relevant emails with candidate workflows and does not write or delete messages in user inboxes.
Compliance notes
- Ashby does not store or process non-recruiting-related emails.
- Ashby does not fetch the full email body unless the message is recruiting-relevant.
- This behavior applies across both standard Microsoft 365 and GCC tenants.
Lower privilege alternatives for Microsoft 365
While Ashby recommends the above integration methods, widely adopted even in sensitive industries like finance and health care, we understand that some security teams may have different risk assessments. To address this, Ashby offers alternatives with more restricted access, though these come with reduced functionality for your Talent team. For the full permission details of each integration option, see Integration options for Google Workspace and Microsoft 365Integration options for Google Workspace and Microsoft 365.
OAuth a separate Microsoft 365 account for each hiring team member
If you prefer not to provide access to internal employee accounts, you can create dedicated email accounts for hiring team members (e.g., [employee name]@[secondary domain]) under a separate domain within your organization.
Limitations:
- Team members must manage two inboxes: their primary inbox and the separate hiring account.
- Internal calendar access is restricted, impacting Ashby's automated and manual scheduling features.
- Workaround: Calendars can be manually shared with these accounts for partial visibility, but ongoing maintenance is required as new accounts or calendars are added.
OAuth a shared Microsoft 365 account
Alternatively, you can create a shared email/calendar account (e.g., hiring@[your domain]) for the Talent team to use. This account can be shared in Ashby for sending emails and managing scheduling.
Limitations:
- Candidate experience is compromised:
- Emails do not show the recruiter's name.
- Communication cannot be visually separated by role (e.g., recruiter vs. hiring manager).
- Restricting access to interviewer calendars prevents the use of automated and manual scheduling features.