# The Office Assistant: information for IT teams An AI add-in for Microsoft Word, Excel, PowerPoint and Outlook. This sheet covers what it can access, where data goes, what to allow on the network, and how to deploy and remove it. ## What it is - **An assistant in a task pane** beside the open document, workbook, deck, email or meeting. It acts only on a request the user types in the pane. - **Provided by Tessellant**, and runs through your organisation's own Tessellant platform. - **Named for your organisation.** In Office it is **Tessellant Office Assistant**, shown as **Tessellant Assistant** on the **Home** tab and the right-click **Ask** item, or a name your organisation chose. - **Enabled app by app.** Your organisation chooses which of the four apps it works in. Elsewhere it shows a short "not enabled" message and does nothing else. - **Help for staff** is in the [how-to guide](https://tessellant.com.au/office-assistant/guide/), which **Help** in the pane opens. - **Capabilities and roadmap:** the guide lists [what it can do](https://tessellant.com.au/office-assistant/guide/#what-it-can-do) today and [what's coming next](https://tessellant.com.au/office-assistant/guide/#whats-coming-next). ## What it can access The add-in comes as two manifest files, each requesting one permission, quoted exactly. | App | Permission | Scope | |---|---|---| | Word, Excel, PowerPoint | `ReadWriteDocument` | The open document only. No access to other files. | | Outlook | `ReadWriteItem` | The open email or meeting only, including in a shared mailbox or delegate folder. Not the mailbox. | It can't: - **send email.** In Outlook it writes drafts only. It has no send function, an automated test fails the build if one is added, and it has no on-send checks or Smart Alerts. - **open other files, folders or mailboxes,** beyond files the user attaches in the pane and knowledge bases they can already read on your platform. - **browse the web.** It has no web search, code execution, image generation or other server-side tools. ## Where data goes 1. **The pane is served from your platform,** at `https:///office/`. There is no installer. 2. **Content the assistant reads is sent to your platform,** which runs the AI model. The model provider is as set out in your organisation's Tessellant platform agreement. 3. **Chats are saved in the user's history on your platform:** every message, each step the assistant took, and a log of approvals, reverts, sign-in and errors. The log never holds sign-in tokens. There are no third-party analytics or tracking: only Microsoft's Office JavaScript library loads from outside your platform. | Stored in | What | |---|---| | The add-in's browser storage | `oa.token`, the sign-in session, removed on **Sign out**; `oa.trackEdits`, a Word preference. | | Cookies for your chat host | The platform's sign-in cookie, and `oa_dialog` (10 minutes, set during sign-in). | | Word, Excel and PowerPoint files | `tessellantDocId` in the add-in's document settings: a random identifier for resuming chats, with nothing about the content. | | Outlook messages | Nothing. | ## Sign-in and control - **Microsoft sign-in** with the user's work account, through your platform's existing login. Your Microsoft Entra policies, such as MFA and Conditional Access, apply. Nothing changes in Entra. - **Approved users only.** A group on your platform controls who can use it. - **Edits need approval by default.** The user approves each change, can switch asking off, and can revert each turn's changes from the pane. - **Tracked changes in Word.** Your organisation can require the assistant's edits to be tracked for everyone. - **Behind Cloudflare Access,** only the add-in's static files (`/office/`) are exempt. The platform's API and sign-in stay behind Access. ## Network Allow these from users' devices. | Address | Why | |---|---| | `https://` | The pane, sign-in and the platform. | | `https://login.microsoftonline.com` | Microsoft sign-in. | | `https://appsforoffice.microsoft.com` | Microsoft's Office JavaScript library. | | `https://.cloudflareaccess.com` | Cloudflare Access sign-in, where used. | Office on the web behind Cloudflare Access needs third-party cookies allowed for your chat host. Edge and Chrome allow them by default; Safari blocks them. Desktop Office is unaffected. ## Deploy Your Tessellant contact provides two manifest files: one for Word, Excel and PowerPoint, and one for Outlook. Upload the files rather than a URL. 1. In the Microsoft 365 admin centre, go to **Settings > Integrated apps > Upload custom apps**, choose **Office Add-in**, and upload the first file. 2. Assign it to users or a group (nested groups aren't supported), then deploy. 3. Repeat for the second file. 4. Allow 24 to 72 hours for it to appear. Users may need to restart Office. This needs a Global Administrator, or an Exchange Administrator who also holds the Application Administrator role. See Microsoft's [Deploy Office Add-ins in the Microsoft 365 admin center](https://learn.microsoft.com/microsoft-365/admin/manage/manage-deployment-of-add-ins) and [Requirements to use centralized deployment](https://learn.microsoft.com/microsoft-365/admin/manage/centralized-deployment-of-add-ins). ## Updates and removal - **Updates are automatic.** Users get a new release from your platform the next time they open the pane. A re-upload is needed only for rare manifest changes, such as a new chat host, broader permissions or a new Office app, and your Tessellant contact will provide the files. - **Removal.** Remove both add-ins in **Settings > Integrated apps**. Only the admin who deployed them or a Global Administrator can. Tessellant can also switch the assistant off on your platform. Chat history stays on the platform. ## Contact Your Tessellant contact, or [connect@tessellant.com.au](mailto:connect@tessellant.com.au). Last updated 14 October 2026, describing add-in release 0.3.0.