Aristo setup & permissions

🔒 Not connected yet. Sign in with your work account and grant the admin consent; the seat count starts the moment consent lands and this page fills in a minute or two later. One click covers the whole registration, Mail.Send (delegated) included — which is not a read.

1Grant admin consent — one click, scoped; it covers the whole registration, Mail.Send (delegated) included
2Choose your rollout — a pilot cohort or the whole org
3Aristo takes it from here — warm daily wins, opt-out always honored

Actions and personal visibility

Actions on your behalf require your own press. With admin consent, Aristo also acts as the app: Teams messages, the weekly sponsor digest, and a seat move after a leader approves it. Three operational emails are sent as the app: an enabled consumption signal to a named account contact, a sandbox-access notice, and a return-consent challenge. Named department views follow the organization’s visibility policy, each person’s naming choice and the five-person floor; personal activity stays private.

The required usage-report reads are listed below. Microsoft shows the complete consent before you grant it. The same click includes Mail.Send (delegated). A delegated send permission lets Aristo send a message as the signed-in person when they ask. Leader views follow your organization’s visibility policy, the five-person floor and each person’s naming choice.

What Aristo will ask for, and why

Every permission Aristo asks for: what it lets Aristo do, whether it reads or writes, whether it is required, and whether it is granted
Permission	What it lets Aristo do	Reads or writes	Required	State
Reports.Read.All	Copilot adoption Read usage reports to count adoption by team, with at least five people in every named team.	Reads	Required	Not checked
ReportSettings.Read.All	Name visibility Read whether Microsoft conceals names in usage reports; honor that setting.	Reads	Required	Not checked
User.Read.All	Departments Read directory profiles to group people by department. Names require the organization’s visibility policy and each person’s choice.	Reads	Required	Not checked
Organization.Read.All	Licenses Read the organization’s purchased and assigned licenses.	Reads	Required	Not checked
ServiceMessage.Read.All	Message Center Read the organization’s Message Center announcements.	Reads	Required	Not checked
CopilotPackages.Read.All	Agent inventory Read the organization’s Copilot agents, so the register lists agents Aristo did not build. It arrives with the core consent and setup is complete without it; the feature also needs Microsoft Agent 365 licensing. Without it, only agents built with Aristo appear on the register.	Reads	Opt-in	Not checked
LicenseAssignment.ReadWrite.All	Move an approved seat Change license assignments to move a seat ready to activate to a consenting teammate after approval. Without it, Aristo hands your administrator the steps instead of moving the seat.	Writes	Opt-in	Not checked
AppCatalog.ReadWrite.All	Approved app catalog Read and change the organization’s app catalog. Publishing that Microsoft requires an administrator to perform is handed to that administrator. Without it, an approved agent ends as a package for your administrator to publish.	Writes	Opt-in	Not checked
TeamsAppInstallation.ReadWriteForUser.All	Approved app installation Install or remove approved Teams apps for people who requested them. Without it, those people install the app themselves.	Writes	Opt-in	Not checked
GroupMember.Read.All	Approver and leader groups Read membership of the security groups the organization names for access and approvals. Without it, group-based approvals are refused.	Reads	Opt-in	Not checked
Mail.Read	Optional inbox help Read only mailboxes covered by the organization’s verified Exchange policy, for people who chose inbox help. Without it, there is no inbox help and everything else is unchanged.	Reads	Opt-in	Not checked
Mail.Send	Operational email Send email as the application. It comes with the extended consent; Aristo sends its operational email from its own mailbox and does not use this permission in your organization. It can send mail and is not a read.	Writes	Opt-in	Not checked
LicenseAssignment.ReadWrite.All	Optional license writer Separate license-only consent for approved seat moves. It grants no mail or app-installation access. Without it, the move stays off.	Writes	Opt-in	Not checked
User.Read	Your profile Read the signed-in person’s profile.	Reads	Core consent · delegated	Not checked here
offline_access	Keep your sign-in Maintain access the signed-in person granted without asking them to sign in for each request.	Keeps access	Core consent · delegated	Not checked here
Mail.Read	Your email Read the signed-in person’s email for the help they request.	Reads	Core consent · delegated	Not checked here
Mail.Send	Your email reply Send email as the signed-in person, only when that person presses send.	Writes	Core consent · delegated	Not checked here
Calendars.Read	Your calendar Read the signed-in person’s calendar to prepare for a meeting they ask about.	Reads	Core consent · delegated	Not checked here

One admin consent grants Aristo six Microsoft Graph read permissions across your organization; for a person who uses Aristo, it can also read their mail and calendar and send mail as them, only when they ask. Setup needs five of the six reads; CopilotPackages.Read.All (agent inventory) is optional and comes with the same consent. The same click grants five delegated permissions for the signed-in person: User.Read, offline_access, Mail.Read, Mail.Send and Calendars.Read. Mail is sent only when that person presses send. Writes across your organization need the separate, optional extended consent. The extended consent grants its permissions together; each feature still needs its own approval or choice. An administrator can revoke either consent in Microsoft Entra at any time. 18 permissions: 5 required application reads, 5 delegated permissions (1 write), and 8 opt-in application permissions (5 writes). Counted from Aristo’s own permission list — what it asks for at consent. What your organization has granted is checked separately. Not asked at consent: SecurityEvents.Read.All, which reads Microsoft Secure Score. An administrator grants it in Microsoft Entra to add the security pillar; without it, the score is counted without that pillar.

1 December 2026 readiness

From 1 December 2026, new Copilot Business seats bought through a partner bill pay-as-you-go by default.

It applies to new licenses bought through a partner; seats you already hold are unchanged. The meter was always there — what moves is the default. Source: Microsoft Partner Center — October 2026 announcements (the page Microsoft dates 1 October 2026).

Microsoft moved this from 2 November to 1 December 2026, announced 1 October 2026.

46 days to 1 December 2026 Not started

Preview. This is the check as your admin will see it. Sign in to declare your own — nothing here is saved from a preview.

Three things are true before the first credit is drawn:

not set

Azure subscription attached for pay-as-you-gomeasured

Ready to connect — Sign in to settings to paste your Azure subscription id and this row turns green on its own.

not declared

A spending policy exists before the first creditdeclared

Ready to declare — the policy is created in your Microsoft 365 admin center (Billing → Copilot), and you tick it here so this verdict stays honest.

not declared

Who is in the policydeclared

Ready to declare — name the security group(s) the policy scopes to (group names, never people).

A policy with a limit of one credit still grants access; someone in no policy has no access — Microsoft’s Cowork admin governance page.

Starter spending policy — a template to apply in your admin center

Aristo does not write policies. This is a shape to apply yourself in your Microsoft 365 admin center under Billing, and to change freely — every limit in it is yours to choose, not ours to set.

One org-wide policy with a modest per-user monthly limit, so everyone has an owner and a limit from day one.
A second policy for your pilot group with a higher per-user limit, so the people doing the heaviest work are not the ones waiting.
Alerts on, so a change in pace reaches you as a message you can act on.

Where two policies cover the same person, Microsoft picks one: the highest per-user limit first, then the largest overall policy limit, then the most recently created policy — they do not combine (Microsoft Learn on managing Copilot Credits). Any Aristo threshold you set stays an alert, not a cap — the cap lives in your spending policy.

A Microsoft 365 administrator grants consent. Read the full security review · Sign in to see your organization’s grant state