Zero-access architecture in Cloud Drive Mapper
SOLUTION GUIDE
Cloud Drive Mapper operates inside your Microsoft 365 tenant using purely delegated permissions. In practice this means CDM can only ever see what a specific signed-in user is already permitted to see, using that user's own account. IAM Cloud, the company, has no access to your Microsoft 365 environment or the data inside it. If IAM Cloud's cloud systems were compromised, an attacker would not gain access to your tenant either. This page explains what zero-access architecture means in Microsoft 365, what it takes to actually build a product that way, and what a security team should look for when reviewing any third-party tool that touches their tenant.
What we mean by "zero-access architecture"
Zero-access architecture is the property of a software product where the vendor cannot see or reach customer data, even in principle. Not "we promise not to look". Not "we log access and audit ourselves". The system is designed so that the vendor's servers, the vendor's staff, and any hypothetical attacker who compromises the vendor never hold credentials, tokens or keys that would let them reach the customer's environment.
For a Microsoft 365 tool, zero-access means the product runs on the user's behalf using that user's own authentication and authorisation. Not on the vendor's behalf using vendor-controlled credentials. Every file the tool reads or writes is a file the signed-in user was already entitled to read or write, using an access token issued by Microsoft to that user, and only usable from within the user's session.
This is a technical property, not a marketing claim. It can be verified by looking at how the product authenticates to Microsoft 365 (Microsoft's admin-consent flow will show you) and by looking at which permission scopes it requests (also visible in the Entra ID consent screen).
Delegated versus application permissions in Microsoft 365
Microsoft 365 supports two fundamentally different ways for a third-party application to access data in a tenant. The distinction matters more than most vendor conversations make it sound.
Delegated permissions
Delegated permissions run in the context of a signed-in user. The application asks Microsoft for permission to act on that user's behalf. The user, or an admin on behalf of many users, consents. From then on, every request the application makes to Microsoft 365 carries that specific user's identity and is subject to that user's own access controls. If Alice is signed in, the application can only see files Alice can see. If Alice signs out, the application loses access.
Application permissions
Application permissions run in the context of the application itself, not any user. The vendor's application authenticates to Microsoft as itself, holding a client secret or certificate that lives on the vendor's servers. Once granted, the application can access data across the tenant regardless of any specific user's session. Application permissions typically carry very broad scopes: read all files, read all sites, read all emails.
Neither model is wrong. They are for different jobs. A tenant-wide compliance scanner or a backup tool legitimately needs application permissions to do what it does. A user-facing productivity tool typically does not.
The choice a vendor makes is visible to your tenant admin. When the vendor asks for admin consent to install the app, the consent screen lists every permission scope requested and shows whether it is delegated or application. This is the moment to look carefully.
How Cloud Drive Mapper uses your Microsoft 365 permissions
Cloud Drive Mapper uses delegated permissions only. When a user signs in through the CDM desktop client, they authenticate to Microsoft 365 through Microsoft's standard OAuth flow. Microsoft issues an access token bound to that user. CDM uses that token to talk to Microsoft Graph on the user's behalf.
Every file operation CDM performs, whether that is browsing a SharePoint site, opening a document or saving a change, is executed as the signed-in user, subject to that user's own SharePoint and OneDrive permissions. If the user does not have access to a particular library, CDM cannot open it. If the user has read-only access, CDM cannot save changes.
CDM does not hold a service-account credential for your tenant. It does not have a client secret that operates across your organisation. It does not have an application permission granting it read-all-files scope. The vendor (IAM Cloud) has no way to authenticate as your tenant, because there is no vendor-side credential that would do so.
What this means in three concrete scenarios
What if IAM Cloud's cloud systems were compromised?
An attacker who breached IAM Cloud's cloud infrastructure would not, as a result, gain access to your Microsoft 365 tenant. There is nothing on IAM Cloud's side that would authenticate to your tenant. Your users' access tokens are held only on your users' devices, not on IAM Cloud's servers, and each token is short-lived and scoped to a single user.
The attacker would have access to CDM's own configuration data (the policies you have set in Iris, the list of your users, license and metering information). They would not have access to your files.
What if a rogue IAM Cloud employee tried to access your data?
Same architectural answer. An IAM Cloud employee has no credentials that authenticate to your tenant. They could not, from inside IAM Cloud's own systems, open a user's OneDrive or a SharePoint document library. What they would need is your organisation's own admin credentials, which they do not have and which are not shared with IAM Cloud in any form.
There is a "trust the vendor's staff" question in every vendor relationship. Zero-access architecture reduces the surface where that trust matters. IAM Cloud staff cannot access your data because the mechanism to do so does not exist.
What if User A tries to access content belonging to User B?
They cannot, because CDM enforces access at the Microsoft 365 layer, not the CDM layer. When User A signs in through CDM, they can browse only what their own Microsoft 365 permissions allow. If User B has private OneDrive content, User A never sees it. CDM is not a shortcut around SharePoint's access controls. It is a client that respects them.
What data does IAM Cloud actually hold?
Being straightforward about this is more credible than claiming zero data. IAM Cloud does hold some data on its own systems, all of it necessary to run the CDM service. Specifically:
- User identifiers. Sign-in email addresses (User Principal Names) for each user of CDM, so we can associate them with the correct customer tenant and license count.
- Configuration policies. The settings your Iris administrator has chosen: which drives to map, which SharePoint sites to include or exclude, how caches should behave.
- Metering data. Aggregate usage figures to bill accurately, count active users, and monitor service health.
- Support and telemetry logs. Diagnostic information generated by the CDM client when errors occur. Configurable by the tenant admin.
We do not hold your file contents. We do not hold copies of documents from your SharePoint libraries or OneDrive. We do not maintain a shadow index of your content. Files are streamed from Microsoft's servers to your users' devices at request time, using each user's own access token, and IAM Cloud is not in that path.
The full picture of what we process, why, and under what legal basis is in the Privacy Policy and the Data Protection Agreement, both linked below.
Independent assurance: ISO 27001 since 2016
Architecture is one form of assurance. Third-party audit is another. IAM Technology Group Ltd has held ISO/IEC 27001 certification continuously since 2016, currently 27001:2022, covering the design and operation of Cloud Drive Mapper and our supporting cloud services.
An ISO 27001 certificate does not, in itself, prove that a product's architecture is zero-access. What it does prove is that we operate under a formal Information Security Management System, subject to annual external audit, with documented controls covering access, personnel, incident response, supplier management, cryptography, and everything else the standard covers. The current certificate is available on request.
Reviewing any third-party Microsoft 365 tool
The principles above are worth applying to any product that touches your Microsoft 365 tenant, not just Cloud Drive Mapper. The short version, seven questions to put to any vendor:
- Delegated or application permissions?
- What credentials does the vendor hold that authenticate to our tenant?
- If the vendor is compromised, what is the blast radius inside our tenant?
- What data does the vendor hold on their own systems, and for what purpose?
- Are file contents ever stored, indexed or copied on the vendor's infrastructure?
- Does the vendor hold a current independent security certification?
- Where is data processed and stored?
Each of these has a fuller treatment (what a good answer looks like, red flags, how to verify) in the standalone guide Seven questions to ask any third-party tool on your Microsoft 365 tenant, linked below.
Frequently asked questions
Does Cloud Drive Mapper store copies of our files?
No. Files are streamed from Microsoft 365 to your users' devices at the moment they open them, using each user's own access token. Cloud Drive Mapper does not maintain a shadow index or archive of your content on IAM Cloud servers.
What Microsoft Graph permission scopes does Cloud Drive Mapper request?
Only the delegated Microsoft Graph scopes needed for a signed-in user to browse and modify their own OneDrive and the SharePoint sites they are permitted to access. The exact scope list is shown on the Microsoft admin-consent screen when your tenant admin first approves the app. Cloud Drive Mapper does not request tenant-wide application permissions such as Files.ReadWrite.All or Sites.FullControl.All.
If we install Cloud Drive Mapper, can IAM Cloud staff read our files?
No. IAM Cloud staff have no credentials that authenticate to your tenant. The mechanism that would be needed to access your files does not exist in the system. Only your own signed-in users can access your content through CDM.
What happens if IAM Cloud is compromised?
An attacker who breached IAM Cloud's systems would not, as a consequence, gain access to your Microsoft 365 tenant. Access tokens for your users are held on your users' own devices, not on IAM Cloud's servers, and there is no vendor-side credential that would authenticate to your tenant.
Is Cloud Drive Mapper certified?
Yes. IAM Technology Group Ltd holds ISO/IEC 27001 certification continuously since 2016, currently 27001:2022. The current certificate is available on request via our sales team.
How does Cloud Drive Mapper's architecture differ from a typical Microsoft 365 backup or governance tool?
Most backup and governance tools legitimately need application permissions. They run as background services that access content across the tenant regardless of any specific user's session. Cloud Drive Mapper is a user-facing productivity tool: every operation happens in the context of a signed-in user, so delegated permissions are the natural fit. Neither approach is wrong; they are for different jobs. The point is that the choice is deliberate and visible in the admin-consent flow.
Related resources
See it for yourself
Deploy Cloud Drive Mapper for 30 days, free. Your security team can review the admin-consent scopes at the moment they approve the app.