Security · what Aristo holds

Aristo reads Contoso with 5 required read permissions plus 1 opt-in grant — none of them a write, each consented by your admin in Entra.

counted from your tenant’s app token, read live

See every permission Open the security pack

13 application permissions Aristo asks for6 granted

6 read7 not granted

Granted, reads only 6Granted, can write 0Not granted 7

Each grant is consented once by your admin in Entra and revoked there at any time; revoking one darkens the capability beside it and changes no number already counted. No granted application permission can write. Core consent also includes delegated Mail.Send, used only on the signed-in person’s press.

Every permission Aristo asks for: what it lets Aristo do, whether it reads or writes, whether it is required, and whether it is granted
Permission	What it lets Aristo do	Reads or writes	Required	State
Reports.Read.All	Copilot adoption Read usage reports to count adoption by team, with at least five people in every named team.	Reads	Required	Granted
ReportSettings.Read.All	Name visibility Read whether Microsoft conceals names in usage reports; honor that setting.	Reads	Required	Granted
User.Read.All	Departments Read directory profiles to group people by department. Names require the organization’s visibility policy and each person’s choice.	Reads	Required	Granted
Organization.Read.All	Licenses Read the organization’s purchased and assigned licenses.	Reads	Required	Granted
ServiceMessage.Read.All	Message Center Read the organization’s Message Center announcements.	Reads	Required	Granted
CopilotPackages.Read.All	Agent inventory Read the organization’s Copilot agents, so the register lists agents Aristo did not build. It arrives with the core consent and setup is complete without it; the feature also needs Microsoft Agent 365 licensing. Without it, only agents built with Aristo appear on the register.	Reads	Opt-in	Granted
LicenseAssignment.ReadWrite.All	Move an approved seat Change license assignments to move a seat ready to activate to a consenting teammate after approval. Without it, Aristo hands your administrator the steps instead of moving the seat.	Writes	Opt-in	Not granted
AppCatalog.ReadWrite.All	Approved app catalog Read and change the organization’s app catalog. Publishing that Microsoft requires an administrator to perform is handed to that administrator. Without it, an approved agent ends as a package for your administrator to publish.	Writes	Opt-in	Not granted
TeamsAppInstallation.ReadWriteForUser.All	Approved app installation Install or remove approved Teams apps for people who requested them. Without it, those people install the app themselves.	Writes	Opt-in	Not granted
GroupMember.Read.All	Approver and leader groups Read membership of the security groups the organization names for access and approvals. Without it, group-based approvals are refused.	Reads	Opt-in	Not granted
Mail.Read	Optional inbox help Read only mailboxes covered by the organization’s verified Exchange policy, for people who chose inbox help. Without it, there is no inbox help and everything else is unchanged.	Reads	Opt-in	Not granted
Mail.Send	Operational email Send email as the application. It comes with the extended consent; Aristo sends its operational email from its own mailbox and does not use this permission in your organization. It can send mail and is not a read.	Writes	Opt-in	Not granted
LicenseAssignment.ReadWrite.All	Optional license writer Separate license-only consent for approved seat moves. It grants no mail or app-installation access. Without it, the move stays off.	Writes	Opt-in	Not granted
User.Read	Your profile Read the signed-in person’s profile.	Reads	Core consent · delegated	Not checked here
offline_access	Keep your sign-in Maintain access the signed-in person granted without asking them to sign in for each request.	Keeps access	Core consent · delegated	Not checked here
Mail.Read	Your email Read the signed-in person’s email for the help they request.	Reads	Core consent · delegated	Not checked here
Mail.Send	Your email reply Send email as the signed-in person, only when that person presses send.	Writes	Core consent · delegated	Not checked here
Calendars.Read	Your calendar Read the signed-in person’s calendar to prepare for a meeting they ask about.	Reads	Core consent · delegated	Not checked here

One admin consent grants Aristo six Microsoft Graph read permissions across your organization; for a person who uses Aristo, it can also read their mail and calendar and send mail as them, only when they ask. Setup needs five of the six reads; CopilotPackages.Read.All (agent inventory) is optional and comes with the same consent. The same click grants five delegated permissions for the signed-in person: User.Read, offline_access, Mail.Read, Mail.Send and Calendars.Read. Mail is sent only when that person presses send. Writes across your organization need the separate, optional extended consent. The extended consent grants its permissions together; each feature still needs its own approval or choice. An administrator can revoke either consent in Microsoft Entra at any time. 18 permissions: 5 required application reads, 5 delegated permissions (1 write), and 8 opt-in application permissions (5 writes). Counted from Aristo’s own permission list — what it asks for at consent. What your organization has granted is checked separately. Not asked at consent: SecurityEvents.Read.All, which reads Microsoft Secure Score. An administrator grants it in Microsoft Entra to add the security pillar; without it, the score is counted without that pillar.

Decoded from your tenant’s app token, from a reading at most 30 seconds old.