We're configuring ServiceDesk Plus Cloud (OnDemand) to connect to our Microsoft 365 tenant for incoming/outgoing mail (Outlook/Office 365 option under Mail Server Settings). Based on ManageEngine's own OAuth documentation for on-prem/MSP editions, we expected to need to:

• Register our own app in Entra ID
• Generate a Client Secret
• Enter Client ID / Tenant ID / Client Secret into SDP's mail server settings

However, in SDP Cloud, the connection flow only prompted us to sign in with the mailbox account and consent — no fields for Client ID, Tenant ID, or Client Secret appeared.

Our security team needs to understand this before approving the integration, specifically:

1. Is SDP Cloud using a ManageEngine/Zoho-owned multi-tenant Entra application for this connection, rather than requiring us to register our own app?
2. If so, what is the App (client) ID and display name of that application, so we can look it up in our Entra Enterprise Applications / Admin Consent records and review exactly what was consented to?
3. What OAuth scopes/permissions does that app request against our tenant (we've found documentation suggesting Mail.ReadWrite, Mail.Send.Shared, offline_access, but want to confirm this is accurate for the Cloud edition's flow specifically)?
4. Is the consent delegated (scoped to just the signed-in mailbox) or does the app hold any application-level/tenant-wide permissions?
5. Where does the resulting access/refresh token live — is it stored only within our SDP Cloud instance, or does ManageEngine's shared infrastructure have visibility into it?

This is for a security review ahead of enabling mail integration, so any pointers to documentation on the underlying app registration (App ID, permissions manifest, or a security/architecture whitepaper) would be very helpful.

I