# For the IT administrator — one page, two standard options

Your colleague is setting up **Fabric**, a tool that builds a private, searchable copy of
their own mailbox **on their own computer**. Nothing is uploaded to us or to any third
party; the software on their machine reads locally synced or exported mail and writes a
local database file. We need one of two entirely standard things from you — whichever
fits your policy:

## Option 1 — allow IMAP for this one mailbox
Modern-auth IMAP (OAuth2; basic authentication stays off). In Microsoft 365 admin
center: Users → Active users → *the user* → Mail → Manage email apps → tick IMAP.
The user's mail client (Mozilla Thunderbird) then syncs their mailbox locally under
their own sign-in, MFA and Conditional Access included. You can untick it again after
the initial sync if you prefer; refreshes would then ride later exports instead.

## Option 2 — provide a mailbox export (PST)
If you'd rather not touch protocol settings: a standard mailbox export via
eDiscovery / Content Search (or from a Windows machine with classic Outlook:
File → Open & Export → Import/Export → "Outlook Data File (.pst)"). Hand the .pst to
the user directly — it never leaves their custody; the tool reads it locally.

## What we do NOT need
- Nothing of ours OAuth-connects to your tenant: under Option 1 the only sign-in is the
  user's own, through Mozilla Thunderbird's standard Microsoft OAuth flow. (If your
  tenant requires admin approval for new apps, you'll see Microsoft's standard consent
  request for Thunderbird — or simply choose Option 2, which involves no app at all.)
- No mailbox permissions, no service accounts, no forwarding rules, no API access.
- No changes for any other user.

Questions: georgios@baresquare.com. Thank you!
