Aristo setup & permissions

  1. 1Grant admin consent — one click, scoped & read-only
  2. 2Choose your rollout — a pilot cohort or the whole org
  3. 3Aristo takes it from here — warm daily wins, opt-out always honored

Tenant Contoso (demo) · 5/6 capabilities ready · sign in

1 permission still needed

One admin click grants exactly these — tenant-wide, read-only adoption signals.

Grant the missing permissions →
After consenting, Entra returns you here — refresh to confirm all green.

What Aristo needs, and why

granted
Adoption signals
see which seats are active vs cold seats not yet active (aggregate, k-anonymous) (Reports.Read.All)
granted
Real (de-anonymized) names where your IT allows
honor your tenant’s display-concealment setting (ReportSettings.Read.All)
granted
Department insights
group the program by team/department, never per person (User.Read.All)
missing
License truth & SKU detection
count Copilot seats bought vs assigned per SKU, and detect seats already in the renewal grace window (aggregate, never per person) (Organization.Read.All)
granted
Rollout radar
read your tenant’s own Message Center for landing Copilot features (ServiceMessage.Read.All)
granted
Inbox-reactive help (opt-in)
offer a hand on an email — only for users who explicitly opt in, scoped by an Exchange policy (Mail.Read)

Optional expansion — opt-in write

Not part of setup. Aristo stays read-only without these; turn one on only when you want it.
off
License-Saver reroute (opt-in write)
move ONE idle Copilot seat to a consented waitlisted teammate in one Approve — surgical, verified, reversible. Off by default; without it the reroute produces the admin-center handoff instead. (LicenseAssignment.ReadWrite.All)
off
Approvers from an Entra security group (opt-in)
read the membership of the ONE security group you name as agent approvers, so promotion authority is administered where you already administer access. Read-only. Without it, Aristo cannot establish who may approve and refuses every promotion to Prod rather than guessing. (GroupMember.Read.All)

Where your rollout stands

Live from your tenant — honest about what we can and can't see.
installed
Aristo is in Teams
40 people have met Aristo in Teams — the app is installed and live.
confirmed
@Aristo inside Word, Excel, PowerPoint & Outlook
Confirmed — @Aristo answers inside your Copilot apps.
in place
Inbox help is scoped (Exchange policy)
Your Exchange Application Access Policy is confirmed — inbox-watching is limited to the mailboxes you chose, and it stays a per-person opt-in. Fail-closed by design.
🌱 Aristo is watching this rollout — it will nudge the right person in Teams when a step stalls, so you can't miss one.

Aristo only ever reads aggregate adoption signals (five or more people only, never per-person surveillance), and acts as a user only on what they explicitly opt into. Our trust & data-handling →