Connections · what Aristo reads

Every read Aristo needs is granted (5 of 5); connect the Cost Management export next and your dollar figures turn from estimate to measured.

counted from your app token and your saved connections, checked on this visit

Connect the Cost Management export See every permission

12 connections5 answering

5 connected6 not connected1 not measured

Connected 5Not connected 6Not measured — no check exists yet 1

Actions and personal visibility

Actions on your behalf require your own press. With admin consent, Aristo also acts as the app: Teams messages, the weekly sponsor digest, and a seat move after a leader approves it. Three operational emails are sent as the app: an enabled consumption signal to a named account contact, a sandbox-access notice, and a return-consent challenge. Named department views follow the organization’s visibility policy, each person’s naming choice and the five-person floor; personal activity stays private.

Aristo holds 5 required read permissions plus 1 opt-in grant — none of them a write. Your admin grants each once in Entra and can revoke it there; the state is decoded from your app token, live.

Every permission Aristo asks for: what it lets Aristo do, whether it reads or writes, whether it is required, and whether it is granted
Permission	What it lets Aristo do	Reads or writes	Required	State
Reports.Read.All	Copilot adoption Read usage reports to count adoption by team, with at least five people in every named team.	Reads	Required	Granted
ReportSettings.Read.All	Name visibility Read whether Microsoft conceals names in usage reports; honor that setting.	Reads	Required	Granted
User.Read.All	Departments Read directory profiles to group people by department. Names require the organization’s visibility policy and each person’s choice.	Reads	Required	Granted
Organization.Read.All	Licenses Read the organization’s purchased and assigned licenses.	Reads	Required	Granted
ServiceMessage.Read.All	Message Center Read the organization’s Message Center announcements.	Reads	Required	Granted
CopilotPackages.Read.All	Agent inventory Read the organization’s Copilot agents, so the register lists agents Aristo did not build. It arrives with the core consent and setup is complete without it; the feature also needs Microsoft Agent 365 licensing. Without it, only agents built with Aristo appear on the register.	Reads	Opt-in	Granted
LicenseAssignment.ReadWrite.All	Move an approved seat Change license assignments to move a seat ready to activate to a consenting teammate after approval. Without it, Aristo hands your administrator the steps instead of moving the seat.	Writes	Opt-in	Not granted
AppCatalog.ReadWrite.All	Approved app catalog Read and change the organization’s app catalog. Publishing that Microsoft requires an administrator to perform is handed to that administrator. Without it, an approved agent ends as a package for your administrator to publish.	Writes	Opt-in	Not granted
TeamsAppInstallation.ReadWriteForUser.All	Approved app installation Install or remove approved Teams apps for people who requested them. Without it, those people install the app themselves.	Writes	Opt-in	Not granted
GroupMember.Read.All	Approver and leader groups Read membership of the security groups the organization names for access and approvals. Without it, group-based approvals are refused.	Reads	Opt-in	Not granted
Mail.Read	Optional inbox help Read only mailboxes covered by the organization’s verified Exchange policy, for people who chose inbox help. Without it, there is no inbox help and everything else is unchanged.	Reads	Opt-in	Not granted
Mail.Send	Operational email Send email as the application. It comes with the extended consent; Aristo sends its operational email from its own mailbox and does not use this permission in your organization. It can send mail and is not a read.	Writes	Opt-in	Not granted
LicenseAssignment.ReadWrite.All	Optional license writer Separate license-only consent for approved seat moves. It grants no mail or app-installation access. Without it, the move stays off.	Writes	Opt-in	Not granted
User.Read	Your profile Read the signed-in person’s profile.	Reads	Core consent · delegated	Not checked here
offline_access	Keep your sign-in Maintain access the signed-in person granted without asking them to sign in for each request.	Keeps access	Core consent · delegated	Not checked here
Mail.Read	Your email Read the signed-in person’s email for the help they request.	Reads	Core consent · delegated	Not checked here
Mail.Send	Your email reply Send email as the signed-in person, only when that person presses send.	Writes	Core consent · delegated	Not checked here
Calendars.Read	Your calendar Read the signed-in person’s calendar to prepare for a meeting they ask about.	Reads	Core consent · delegated	Not checked here

One admin consent grants Aristo six Microsoft Graph read permissions across your organization; for a person who uses Aristo, it can also read their mail and calendar and send mail as them, only when they ask. Setup needs five of the six reads; CopilotPackages.Read.All (agent inventory) is optional and comes with the same consent. The same click grants five delegated permissions for the signed-in person: User.Read, offline_access, Mail.Read, Mail.Send and Calendars.Read. Mail is sent only when that person presses send. Writes across your organization need the separate, optional extended consent. The extended consent grants its permissions together; each feature still needs its own approval or choice. An administrator can revoke either consent in Microsoft Entra at any time. 18 permissions: 5 required application reads, 5 delegated permissions (1 write), and 8 opt-in application permissions (5 writes). Counted from Aristo’s own permission list — what it asks for at consent. What your organization has granted is checked separately. Not asked at consent: SecurityEvents.Read.All, which reads Microsoft Secure Score. An administrator grants it in Microsoft Entra to add the security pillar; without it, the score is counted without that pillar.

1 December 2026 readiness

From 1 December 2026, new Copilot Business seats bought through a partner bill pay-as-you-go by default.

It applies to new licenses bought through a partner; seats you already hold are unchanged. The meter was always there — what moves is the default. Source: Microsoft Partner Center — October 2026 announcements (the page Microsoft dates 1 October 2026).

Microsoft moved this from 2 November to 1 December 2026, announced 1 October 2026.

68 days to 1 December 2026 Ready for 1 December 2026

Days counted from 24 September 2026, the illustrative day.

Sample. This card is showing its shape on illustrative data — connect your tenant and it reads your own.

Three things are true before the first credit is drawn:

set

Azure subscription attached for pay-as-you-gomeasured

Set ✓ — the one already connected for your cost query. Aristo reads it; it writes nothing to it.

declared

A spending policy exists before the first creditdeclared

Yes — Copilot — whole org. The policy itself lives in your admin center; Aristo records only that you have one.

declared 3 days ago by a leader

declared

Who is in the policydeclared

Copilot pilots

A policy with a limit of one credit still grants access; someone in no policy has no access — Microsoft’s Cowork admin governance page.

declared 3 days ago by a leader

Starter spending policy — a template to apply in your admin center

Aristo does not write policies. This is a shape to apply yourself in your Microsoft 365 admin center under Billing, and to change freely — every limit in it is yours to choose, not ours to set.

One org-wide policy with a modest per-user monthly limit, so everyone has an owner and a limit from day one.
A second policy for your pilot group with a higher per-user limit, so the people doing the heaviest work are not the ones waiting.
Alerts on, so a change in pace reaches you as a message you can act on.

Where two policies cover the same person, Microsoft picks one: the highest per-user limit first, then the largest overall policy limit, then the most recently created policy — they do not combine (Microsoft Learn on managing Copilot Credits). Any Aristo threshold you set stays an alert, not a cap — the cap lives in your spending policy.