A Graph integration that passed enterprise security review first try

Regulation required Meridian to retain advisor–client correspondence and meeting records. Advisors worked in Outlook; compliance worked in a records platform; the bridge between them was a nightly manual export that missed edits and deletions entirely.

Two previous vendor attempts had died in IT security review — over-broad Graph permissions, no tenant-level controls, unclear data flow.

We built the sync on Graph change notifications and delta queries rather than polling — 40k+ items a day without touching rate limits. Permissions were scoped to the minimum application-level set, documented per-scope with justification, and access ran through a reviewed Entra ID app with certificate credentials in Key Vault.

The security-review documentation was a deliverable, not an afterthought: data-flow diagrams, retention behavior, failure modes. Meridian's IT team approved in a single round.

In production for 18 months with zero compliance incidents. Deletions and edits are captured within minutes instead of never. The pattern was solid enough that Meridian commissioned a second integration — Teams meeting records — on the same foundation.