Help with the Outlook add-in that warns you before sending to a likely wrong recipient.
Recipient Guard has two parts, and which ones you get depends on how it is installed.
This is a Microsoft platform rule, not a licensing restriction: Outlook only enables event-based activation — the feature that lets an add-in check a message as it is sent — for add-ins deployed by an administrator.
This takes a few minutes. If you run your own Microsoft 365 tenant, you can deploy it to yourself the same way.
Recipient Guard asks for no Microsoft Graph permissions when it is deployed. Deploying it and granting it permission are two separate things, handled by two different parts of Microsoft 365 — which is why no permissions screen appears during deployment.
Recipient Guard's Smart detection feature reads the signed-in user's frequently-contacted people and saved Outlook contacts, so it can recognise when a recipient differs from the address normally used for that person. By default each user is asked to approve that the first time they turn the feature on.
Administrators can approve it once for everyone instead, so no one in the organisation is ever prompted. The link and the steps are in "An administrator needs to approve this" below — kept in one place so there is only ever one version of it to get wrong.
The permissions requested are read your relevant people list, read your contacts and sign you in and read your profile. Recipient Guard does not read message content, and no data is sent to us — see the Privacy Policy.
This step is optional. Without it the add-in works exactly the same; users are simply prompted individually the first time they turn Smart detection on. Each user still opens the Recipient Guard pane once to switch the feature on.
Deployment is not instant. It can take up to 24 hours to reach every mailbox, and users may need to restart Outlook before the send-time check starts working. The Recipient Guard pane usually appears sooner than the send-time check does — if the pane is there but sends are not being checked yet, the deployment is still propagating.
Smart detection is the optional part that learns which address you normally use for someone, so it can warn when a recipient looks like the wrong one for that person. It reads your frequently-contacted people from Microsoft 365 and, if you allow it, the contacts saved in your Outlook Contacts folder. Both need permission.
Many organisations let people grant that themselves, in which case you are asked once and that is the end of it. Some require an administrator to approve new apps centrally. If yours does, turning Smart detection on will fail and Recipient Guard cannot fix that from inside Outlook — the approval has to happen in your organisation's Microsoft 365 administration.
If Smart detection is already on and Microsoft now says reading your contacts needs admin approval, Smart detection carries on using the people you email. An administrator's approval adds your saved contacts to it.
Everything else keeps working meanwhile. The send-time check still warns about look-alike addresses, recipients who share a name or username, and anyone outside your organisation. Smart detection only adds the comparison against your own contact history.
This is a one-time grant for the whole organisation. Afterwards every user gets Smart detection without being prompted at all.
Approve Recipient Guard for your organisation — sign in with an administrator account, review the three permissions, and approve. Microsoft returns you to a page confirming whether it worked.
Prefer to do it yourself in the portal? Sign in to the Microsoft Entra admin centre as a Global Administrator or Privileged Role Administrator, go to Enterprise applications, find Recipient Guard Add-in, open Permissions and choose Grant admin consent, which grants the same three permissions. If the app is not listed there yet, ask a user to try turning Smart detection on once — the attempt creates the entry.
Don't approve it from inside Outlook. If a user's Recipient Guard sign-in window says it needs admin approval, don't choose "Have an admin account?" and approve there. That window finishes by signing in as the administrator, and Recipient Guard only reads contacts for the mailbox's own account — so it refuses, and the user has to start again. Use the link above or the Entra admin centre instead, ideally in a private browser window.
The consent screen lists the three Graph permissions Recipient Guard uses:
People.Read) — the
frequent contacts Smart detection compares against.Contacts.Read) — the contacts saved in
each user's Outlook Contacts folder. Microsoft builds the frequent-contacts list from mail
already sent, so it cannot include someone saved but not yet written to.User.Read) — part of the
sign-in request; the add-in makes no call with it.It may also show Maintain access to data you have given it access to
(offline_access). This sounds broader than it is. It grants no additional
data: it only lets the add-in refresh the access it already has, so people are not asked
to sign in repeatedly. It is added automatically by Microsoft's authentication library
and is not something Recipient Guard requests.
All of these are delegated — they act only as the signed-in user, and only read that user's own frequent and saved contacts. There is no application-level access, and the add-in cannot read anyone else's mailbox. The contact list is stored in the user's own mailbox; it is never sent to us. Afterwards, Enterprise applications lists the three Graph permissions that were granted. The privacy policy sets out exactly what is stored and how to delete it.
Recipient Guard sends us nothing — no telemetry, no logs, no record of which recipients were flagged or ignored. That is deliberate, and it has a consequence worth being plain about: nothing quietly reports problems back to us. If it gets something wrong, or misses something it should have caught, telling us is the only way we find out.
Email support@recipientguard.co.uk. The most useful things to include:
Please don't include real recipient addresses or message content — Recipient Guard is built so that information never leaves your mailbox, and an email to support would defeat that. A description is enough.
Your Recipient Guard details — copy this into your email. It's your Outlook version and which features are switched on. No addresses, no message content. These stay in your browser: they travel in the part of a link browsers never send to a web server, so they reach us only if you choose to paste them.
If Recipient Guard has been useful, a rating on Microsoft Marketplace genuinely helps other people find it.
Email support@recipientguard.co.uk and we'll get back to you. Please include your Outlook version (new Outlook on Windows, Outlook on the web, or classic Outlook) and a description of the issue.
Recipient Guard has no server and sends none of your data to us. See the Privacy Policy for details.
Recipient Guard is provided by RecipientGuard Ltd, registered in England and Wales (company number 17168880). · Privacy · Terms