Boxcurve Unity: Integrations & Connections

This document enumerates every service Boxcurve Unity connects to, what information is exchanged with each and in which direction, whether the integration is built into the product or configured by your organisation, and, for your security, procurement and data-residency teams, whether each integration can move data outside your Microsoft 365 tenant. The Data Residency & Tenant Isolation document provides the companion treatment of where data resides.

The integrations listed here are the only ones present in Boxcurve Unity. Any service not listed is not integrated by the application. Boxcurve Unity contains no custom application code behind these integrations and uses no artificial-intelligence service.

How to read this document: three layers

Boxcurve Unity reaches other services in three distinct ways. The distinction matters for a vendor review, because the three layers behave differently and carry different data-residency consequences.

1. Microsoft connectors, standard Microsoft connectors (Dataverse, Planner, Teams, Office 365 Outlook, OneDrive for Business, Office 365 Groups, Office 365 Users and Azure DevOps). Each runs inside your own tenant under a connection that authenticates with your organisation's own credentials.
2. Direct web requests inside flows, a small number of integrations are not connectors at all. They are direct web (HTTP) requests made from inside Boxcurve Unity's automation flows to an external address. There are exactly three: the Boxcurve licensing call, the Boxcurve task-pack source and monday.com.
3. Platform internals, connectors the Power Platform uses to operate the application itself (for example, to run the application's flows). These are not data integrations and exchange no business content with any external party; they are listed once, for completeness, at the end.

How Boxcurve Unity connects to Microsoft services

Boxcurve Unity is a Power Platform application. Its Microsoft integrations run as flows inside your own Microsoft 365 tenant, acting on your behalf. Each uses a standard Microsoft connector and runs under a connection that authenticates with your organisation's own credentials. Creating, consenting to and owning those connections is a Power Platform platform function, see Microsoft's documentation: Manage connections in Power Apps and Connection references.

Boxcurve Unity does not introduce its own separate sign-in for these Microsoft services; the connections rely on Microsoft's standard connector authentication.

Microsoft service integrations (connectors)

Microsoft Dataverse

Boxcurve Unity stores its own application data, projects, tasks, stakeholders, accountability-map assignments, settings and logs, in Microsoft Dataverse within your tenant. Every other integration reads from and writes back to this Dataverse data store as its system of record.

• Built-in or customer-configured: Built-in. Dataverse is the application's primary data store.
• Direction: Two-way (read and write).
• What is exchanged: Boxcurve Unity's own project, task, stakeholder, accountability-map, settings and log records.
• Can move data outside the tenant: No. Dataverse data remains in your tenant.

Optional: making Dataverse-resident Unity data answerable in Microsoft 365 Copilot

Because Boxcurve Unity stores its accountability data, the Accountability Map (in RACI, RASCI, RATSI, DACI, DCI or MOCHA format), the Project and Operational maps, the stakeholder records and the roles-by-function assignments, in Microsoft Dataverse within your tenant, your organisation can optionally make that data answerable in natural language through Microsoft 365 Copilot. This is not a Boxcurve Unity feature or connector and there is nothing for Boxcurve to configure: it is enabled entirely by your own administrator turning on Dataverse data in Microsoft 365 Copilot in your Microsoft 365 tenant, and it requires Microsoft 365 Copilot licensing.

When enabled, the capability is read-only and permission-respecting, a user can only ask about and see the Boxcurve Unity data they are already authorised to see. It is off by default. The Capabilities & Data Access document describes the full use case, for example a new joiner asking "what is my accountability", "who does what in my team" or "who is accountable for X".

Enabling this is a Microsoft 365 and Power Platform administrator function, not a Boxcurve Unity setting. See Microsoft's documentation: Dataverse data in Microsoft 365 Copilot and Enable Microsoft 365 Copilot.

Microsoft Planner

Boxcurve Unity synchronises tasks with Microsoft Planner so that work managed in Unity is also visible to teams in Planner.

• Built-in or customer-configured: Built-in feature; uses a connection your team owns.
• Create tasks in Planner: Tasks held in Boxcurve Unity can be created as Planner tasks, including assignment of users and task detail. (Direction: Unity → Planner.)
• Pull tasks from Planner: Tasks and their details can be read from Planner back into Boxcurve Unity. (Direction: Planner → Unity.)
• Status synchronisation: Task status changes are reflected between Boxcurve Unity and Planner, including a per-user task-status synchronisation. (Direction: two-way.)
• What is exchanged: Task titles and details, assignments, and task status.
• Can move data outside the tenant: No. Microsoft Planner is a Microsoft 365 service within your tenant.

Microsoft Teams

Boxcurve Unity posts a notification to a Microsoft Teams conversation when a task is assigned to a person.

• Built-in or customer-configured: Built-in; uses a connection your team owns.
• Direction: Unity → Teams (outbound notification).
• What is exchanged: A message announcing a task assignment. The same assignment event can also send an email notification (see Office 365 Outlook below).
• Can move data outside the tenant: No. Microsoft Teams is a Microsoft 365 service within your tenant.

Office 365 Outlook

Boxcurve Unity sends email through Office 365 Outlook for two purposes: a notification email when a task is assigned to a person, and an email accompanying a task export that contains a link to the exported file (see OneDrive for Business below).

• Built-in or customer-configured: Built-in; uses a connection your team owns.
• Direction: Unity → Outlook (outbound email).
• What is exchanged: Notification messages and, for exports, a link to the exported file.
• Can move data outside the tenant: Email delivery is a Microsoft 365 function. Where the email is addressed is determined by your application data and recipients, not by Boxcurve.

OneDrive for Business

Boxcurve Unity exports task data to a CSV file and stores it in OneDrive for Business, then creates a shareable link to that file and emails it to the recipient.

• Built-in or customer-configured: Built-in; uses a connection your team owns.
• Direction: Unity → OneDrive (file creation), and OneDrive → Unity (file metadata and a share link are read back to include in the email).
• What is exchanged: A CSV file of task data, and a share link to that file.
• Can move data outside the tenant: No. OneDrive for Business is a Microsoft 365 service within your tenant.

Office 365 Groups

Boxcurve Unity adds users holding higher-level Boxcurve Unity roles as owners of a Microsoft 365 group.

• Built-in or customer-configured: Built-in; uses a connection your team owns.
• Direction: Unity → Office 365 Groups (ownership update).
• What is exchanged: The identities of users to be set as group owners.
• Can move data outside the tenant: No. Office 365 Groups is a Microsoft 365 service within your tenant.

Office 365 Users

Boxcurve Unity uses the Office 365 Users connector to resolve user identity information for use within the application.

• Built-in or customer-configured: Built-in; uses a connection your team owns.
• Direction: Office 365 Users → Unity (read).
• What is exchanged: User profile information needed by the application.
• Can move data outside the tenant: No. This reads identity information already held in your tenant.

Azure DevOps

Boxcurve Unity creates a work item in Azure DevOps from a task in the application, so that work defined in Unity can be tracked on an Azure DevOps board.

• Built-in or customer-configured: Built-in feature, inactive until your team enters the target Azure DevOps organisation name and project name on the relevant Boxcurve Unity project record.
• Direction: Unity → Azure DevOps (work item creation), and Azure DevOps → Unity (the created work item's identifier is read back and stored against the task in Unity).
• What is exchanged: A work item of type Task created in the Azure DevOps organisation and project configured on the Boxcurve Unity project record. After creation, Boxcurve Unity records the Azure DevOps work item identifier so that the task can be opened directly in Azure DevOps.
• Can move data outside the tenant: Azure DevOps is a separate Microsoft service. The work-item content you send is written to the Azure DevOps organisation your team configures. Your team should ensure that organisation aligns with your data-residency policy.

Direct web requests inside flows (not connectors)

The following three integrations are not Microsoft connectors. They are direct web (HTTP) requests issued from inside Boxcurve Unity's automation flows to a specific external address. Each reaches a service outside the Microsoft connector framework; the first two reach a Boxcurve-operated endpoint and the third reaches a third-party service. Your security and procurement teams should review all three against your policy for external data flows.

Boxcurve licensing call (built-in)

Boxcurve Unity makes one built-in outbound web request to a Boxcurve-operated licensing endpoint. This request validates the product's licence and retrieves any product notifications Boxcurve has published for display in the application.

• Built-in or customer-configured: Built-in. This call is part of the product and is not configured by your team.
• Direction: Unity → Boxcurve (request), Boxcurve → Unity (response).
• What is exchanged outbound: Your Microsoft tenant identifier and environment identifier, a fixed Boxcurve product key, a marker indicating the most recent product notification already received, and an aggregate licence summary. The licence summary is a count only: for each Boxcurve Unity plan, the number of distinct stakeholder maps. It contains no business content, no project, task, stakeholder, accountability-map or personal data is sent.
• What is exchanged inbound: Licence and subscription status and any product notifications, which are stored as notification records in your tenant.
• Can move data outside the tenant: Yes, this is the one built-in integration that contacts Boxcurve. The data leaving your tenant is limited to the identifiers, product key, notification marker and aggregate counts described above.
• Behaviour on failure: This call is fail-open with respect to access, if it cannot be completed, it does not block users from using the application. The Data Residency & Tenant Isolation document provides the definitive treatment of the licence call, its data minimisation and its fail-open behaviour.

Boxcurve task-pack source (built-in)

Boxcurve Unity imports predefined task lists ("task packs") by requesting them from a Boxcurve-hosted source. The request is a direct, read-only web request to a Boxcurve-published template source.

• Built-in or customer-configured: Built-in feature. The task-pack content it returns is Boxcurve-published template content.
• Direction: Boxcurve source → Unity (inbound import only).
• What is exchanged: A request retrieves a published list of available task lists, which is then imported into Boxcurve Unity. No business data is sent to the external source, this is a download of Boxcurve-published template content.
• Can move data outside the tenant: No outbound business data. The request reaches a Boxcurve-operated address outside your tenant to fetch template content only.

The Boxcurve Unity settings also offer downloadable stakeholder and task import templates hosted by Boxcurve. These are template files for your team to download and complete; they are not a live data integration.

monday.com (customer-configured, optional)

Boxcurve Unity connects to monday.com to retrieve boards and pull tasks from a board into the application. This is an optional, customer-configured integration.

• Built-in or customer-configured: Customer-configured. It is inactive unless your team supplies a monday.com API key (access token); the request authenticates with that user-supplied key.
• Get boards: Retrieves the list of available monday.com boards. (Direction: monday.com → Unity.)
• Pull tasks from a board: Reads tasks from a selected monday.com board into Boxcurve Unity. (Direction: monday.com → Unity.)
• What is exchanged: A request is sent to monday.com under the API key your team supplies; board and task information is read back into Boxcurve Unity. The data flow into your environment is inbound.
• Can move data outside the tenant: Yes, in the sense that the request reaches a third-party service outside Microsoft 365 and outside your tenant, under a key you supply.

monday.com is a third-party service operated outside Microsoft 365 and outside your tenant. Using this import sends a request to monday.com under a token you supply; the board and task data it returns is brought into your environment. If your data-residency or third-party-processing policies restrict this, do not enable or use the feature. monday.com is governed by its own terms.

To connect monday.com, generate an API key in your monday.com account, then paste it into the monday.com access token field in Boxcurve Unity. Once a key is present, the Import tasks from monday.com option becomes available and you can select a board and pull its tasks.

Platform internals (no business data exchanged)

For completeness: Boxcurve Unity also relies on a small number of Power Platform internal connectors used to operate the application itself, for example, to run the application's own flows and to read application metadata. These are platform mechanisms, not data integrations, and they exchange no business content with any external party. Their behaviour is a Power Platform function, see Microsoft's documentation: Connections and connection references.

What your organisation configures

Integration	Layer	What your team configures
Dataverse, Planner, Teams, Outlook, OneDrive, Office 365 Groups/Users, Azure DevOps	Microsoft connector	The underlying connections, using your organisation's own credentials, via the standard Power Platform connection / connection-reference experience.
Azure DevOps (target)	Microsoft connector	The Azure DevOps organisation name and project name on the relevant Boxcurve Unity project record, before the feature can be used.
Boxcurve licensing call	Direct web request	Nothing. Built-in; not configured by your team.
Boxcurve task-pack source	Direct web request	Nothing. Built-in; retrieves Boxcurve-published template content.
monday.com	Direct web request	A monday.com API key (access token), supplied to the application. Optional.

Authentication of the Microsoft connections themselves is a Power Platform platform behaviour. For how connections are created, consented to and owned, see Microsoft's documentation: Manage connections in Power Apps.

How Boxcurve Unity behaves if an integration fails

The integration flows include error handling: where a step fails, the flow stops and reports the failure rather than continuing in an inconsistent state. The application records errors to an internal error log within its Dataverse data store.

The Boxcurve licensing call is fail-open with respect to access: if it cannot be completed, it does not prevent users from using the application. The Data Residency & Tenant Isolation document provides the authoritative treatment.

Retries beyond the Power Platform's standard connector retry behaviour are a platform function. See Microsoft's documentation: Connections and connection references.

How to disconnect an integration

For the Microsoft connectors, removing or revoking a connection is a Power Platform platform function. Connections and connection references are managed and removed by an administrator outside the application. See Microsoft's documentation: Manage connections in Power Apps and Connection references.

For monday.com, the integration is discontinued by removing the API key your team supplied from the monday.com access token field and by not invoking the import. Once the key is removed, the import options are no longer available.

The Boxcurve licensing call and the Boxcurve task-pack source are built into the product and are not configured or disconnected through the application. Restricting outbound traffic to those endpoints is a tenant-level network and governance decision for your organisation rather than an in-application setting.