Invites by Systam add-in: Technical overview

Invites by Systam is an Outlook add-in that adds the correct Systam invite address to a meeting for the organizer. The add-in doesn't create visits itself. The visit is created through calendar invites when the meeting is sent.

In short:

• The add-in only handles the attendee list of the meeting that's open. It doesn't send meeting details to Systam.
• The only thing sent to Systam is the user's email address, used to look up their invite addresses. It isn't stored.

Where the add-in appears

• The Invites by Systam button appears when the organizer creates or edits a meeting in Outlook desktop or Outlook on the web. The button opens a side panel.
• The add-in doesn't appear in read messages, received meetings or the Outlook mobile app.
• The add-in works in Finnish and English, following Outlook's language.

How it's used

1. The organizer opens the side panel while creating a meeting.
2. The add-in fetches the organizer's workspaces, visit types and their invite addresses from Systam Visit.
3. The remembered choice, or the primary workspace and its primary visit type, is selected by default.
4. The invite address of the selected visit type is added to the meeting's required attendees right away. If the meeting already had another Systam invite address, it's removed.
5. The organizer can change the workspace or visit type and choose to remember the choice.
6. Confirm closes the panel. Clearing the selection removes all Systam invite addresses from the meeting.
7. When the organizer sends the meeting, the visit is created through calendar invites.

What the add-in reads and writes

Security

Outlook permissions

• The add-in requests Outlook's narrowest write permission (ReadWriteItem). It applies only to the meeting the user has open, not the rest of the mailbox.
• The add-in is available only in the organizer's meeting view.
• The add-in requests no Microsoft Graph permissions and no admin consent in your Entra ID.

Connection to Systam Visit

• The add-in makes a single read request to the Systam Visit API over encrypted HTTPS. The request contains the user's email address as reported by Outlook.
• The response contains only the names of the user's workspaces and visit types and their invite addresses. The API returns no visits and no data about other people, and nothing can be changed through it.
• Systam Visit accepts browser requests only from Systam's own addresses, such as the add-in's address addin.systam.io.

Hosting and browser

• The add-in's pages are static files hosted on Google Cloud in Finland. The server stores no data and doesn't handle meetings.
• Production releases require approval and are scanned for vulnerabilities.
• The add-in stores no credentials, cookies or data in the browser's local storage.
• The only external script is Microsoft's Office.js library, loaded from Microsoft's own service. There's no analytics or tracking.
• Internet Explorer and legacy Edge aren't supported.

Data location and retention

The add-in stores no data with Systam. The only data sent to Systam is the user's email address for looking up invite addresses.

Deployment

• Your organization's admin enables the Invites by Systam extension in Systam Studio and downloads the add-in's installation file (XML manifest).
• The file is installed for a single user in Outlook, or for the whole organization through Centralized Deployment in the Microsoft 365 admin center. Step-by-step guide: Install Invites by Systam add-in for Outlook.
• The add-in isn't distributed through Microsoft AppSource.
• The organizer must be a Systam Visit user with an invite address set for their workspaces. Otherwise the panel shows that the user has no access.

What your IT needs to do

The add-in needs no application permissions or admin consent in your Entra ID. What's left for IT is installation and a few checks.

• Enable the Invites by Systam extension in Systam Studio and download the installation file.
• Deploy the add-in centrally in the Microsoft 365 admin center, or let users install it themselves.
• If your network filters traffic, allow addin.systam.io, api.systam.io and appsforoffice.microsoft.com.
• Check the calendar invite requirements: invitations to external addresses are allowed, and users' email addresses in Systam Visit match their Outlook addresses. See Calendar invites: Technical overview.

See also

• Calendar invites: Technical overview
• Install Invites by Systam add-in for Outlook

That covers the technical core of the add-in. Reach out if any part needs more detail for your environment.