Granted, reads only 6Granted, can write 0Not granted 7
Each grant is consented once by your admin in Entra and revoked there at any time; revoking one darkens the capability beside it and changes no number already counted. No granted application permission can write. Core consent also includes delegated Mail.Send, used only on the signed-in person’s press.
Scroll sideways for the remaining columns.
Every permission Aristo asks for: what it lets Aristo do, whether it reads or writes, whether it is required, and whether it is granted
Permission
What it lets Aristo do
Reads or writes
Required
State
Reports.Read.All
Copilot adoption
Read usage reports to count adoption by team, with at least five people in every named team.
Reads
Required
Granted
ReportSettings.Read.All
Name visibility
Read whether Microsoft conceals names in usage reports; honor that setting.
Reads
Required
Granted
User.Read.All
Departments
Read directory profiles to group people by department. Names require the organization’s visibility policy and each person’s choice.
Reads
Required
Granted
Organization.Read.All
Licenses
Read the organization’s purchased and assigned licenses.
Reads
Required
Granted
ServiceMessage.Read.All
Message Center
Read the organization’s Message Center announcements.
Reads
Required
Granted
CopilotPackages.Read.All
Agent inventory
Read the organization’s Copilot agents, so the register lists agents Aristo did not build. It arrives with the core consent and setup is complete without it; the feature also needs Microsoft Agent 365 licensing. Without it, only agents built with Aristo appear on the register.
Reads
Opt-in
Granted
LicenseAssignment.ReadWrite.All
Move an approved seat
Change license assignments to move a seat ready to activate to a consenting teammate after approval. Without it, Aristo hands your administrator the steps instead of moving the seat.
Writes
Opt-in
Not granted
AppCatalog.ReadWrite.All
Approved app catalog
Read and change the organization’s app catalog. Publishing that Microsoft requires an administrator to perform is handed to that administrator. Without it, an approved agent ends as a package for your administrator to publish.
Writes
Opt-in
Not granted
TeamsAppInstallation.ReadWriteForUser.All
Approved app installation
Install or remove approved Teams apps for people who requested them. Without it, those people install the app themselves.
Writes
Opt-in
Not granted
GroupMember.Read.All
Approver and leader groups
Read membership of the security groups the organization names for access and approvals. Without it, group-based approvals are refused.
Reads
Opt-in
Not granted
Mail.Read
Optional inbox help
Read only mailboxes covered by the organization’s verified Exchange policy, for people who chose inbox help. Without it, there is no inbox help and everything else is unchanged.
Reads
Opt-in
Not granted
Mail.Send
Operational email
Send email as the application. It comes with the extended consent; Aristo sends its operational email from its own mailbox and does not use this permission in your organization. It can send mail and is not a read.
Writes
Opt-in
Not granted
LicenseAssignment.ReadWrite.All
Optional license writer
Separate license-only consent for approved seat moves. It grants no mail or app-installation access. Without it, the move stays off.
Writes
Opt-in
Not granted
User.Read
Your profile
Read the signed-in person’s profile.
Reads
Core consent · delegated
Not checked here
offline_access
Keep your sign-in
Maintain access the signed-in person granted without asking them to sign in for each request.
Keeps access
Core consent · delegated
Not checked here
Mail.Read
Your email
Read the signed-in person’s email for the help they request.
Reads
Core consent · delegated
Not checked here
Mail.Send
Your email reply
Send email as the signed-in person, only when that person presses send.
Writes
Core consent · delegated
Not checked here
Calendars.Read
Your calendar
Read the signed-in person’s calendar to prepare for a meeting they ask about.
Reads
Core consent · delegated
Not checked here
One admin consent grants Aristo six Microsoft Graph read permissions across your organization; for a person who uses Aristo, it can also read their mail and calendar and send mail as them, only when they ask. Setup needs five of the six reads; CopilotPackages.Read.All (agent inventory) is optional and comes with the same consent. The same click grants five delegated permissions for the signed-in person: User.Read, offline_access, Mail.Read, Mail.Send and Calendars.Read. Mail is sent only when that person presses send. Writes across your organization need the separate, optional extended consent. The extended consent grants its permissions together; each feature still needs its own approval or choice. An administrator can revoke either consent in Microsoft Entra at any time. 18 permissions: 5 required application reads, 5 delegated permissions (1 write), and 8 opt-in application permissions (5 writes). Counted from Aristo’s own permission list — what it asks for at consent. What your organization has granted is checked separately. Not asked at consent: SecurityEvents.Read.All, which reads Microsoft Secure Score. An administrator grants it in Microsoft Entra to add the security pillar; without it, the score is counted without that pillar.
Decoded from your tenant’s app token, from a reading at most 30 seconds old.