FollowUp for IT admins
FollowUp checks in with a company's vendors about ship dates on purchase orders, by email from the company's own shared mailbox. Here is everything it asks of your Microsoft 365, in about 15 minutes of your time.
Approve FollowUp (sign-in only)
A Global Administrator or Cloud Application Administrator approves FollowUp once for your organisation. FollowUp asks Microsoft for sign-in and basic profile (name, email) only. Approving gives it no access to any mailbox, file, calendar or contact.
Give it one shared mailbox
An Exchange administrator grants FollowUp one shared mailbox (for example purchasing@yourcompany.com) with Exchange's RBAC for Applications, scoped to that address with a management scope. FollowUp sends check-ins from it and reads vendors' replies in it. It also reads that mailbox's Sent Items, with the same grant, so POs your team sends from it are picked up without anyone copying FollowUp in; anything that isn't a PO is skipped and not kept. The commands are filled in for you on the link your colleague sends, ending with Test-ServicePrincipalAuthorization so you can check it yourself.
Optional: pick up POs people send from their own mailboxes
If your team sends POs from their own Outlook rather than the shared mailbox, an Exchange administrator can add a mail flow (transport) rule: a blind copy of outgoing mail from a group you choose, when it has a PDF and mentions a PO, to your company's own FollowUp address. FollowUp accepts those copies only when they pass DMARC and come from your verified domain, and ignores anything that isn't a PO without keeping it. Remove-TransportRule undoes it.
What FollowUp never gets
- Access to any other mailbox. FollowUp doesn't ask Microsoft for it, so there's nothing to narrow afterwards.
- Files, calendars, contacts, Teams or other users' data.
- Passwords. FollowUp stores your organisation's ID and the mailbox address, nothing secret.
- DNS changes. Mail goes out through your own Microsoft 365, so SPF and DKIM are unchanged.
Removing it
Microsoft Entra → Enterprise applications → FollowUp → Delete stops FollowUp signing in to your organisation at once, so the mailbox grant can no longer be used. The commands that also remove the grant from Exchange are on our Security page, and on the link your colleague sent (Undo everything). If you added the mail flow rule, Remove-TransportRule removes it. Inside FollowUp, Disconnect stops it using the mailbox at once.
Questions: setup@vendorfollowup.com