Trust · for your security review

One admin consent grants Aristo six Microsoft Graph read permissions across your organization; for a person who uses Aristo, it can also read their mail and calendar and send mail as them, only when they ask. Leaders see only teams of 5 or more, and Aristo never trains on your data — SOC 2 is in progress, stated plainly.

counted from Aristo’s own permission list — what it asks for at consent

Download the security pack Sign in · Review and grant the admin consent

13 application permissions, all revocable in Entra5 required

5 required reads 3 opt-in reads 5 opt-in writes

8 more permissions are opt-in, 5 of them writes. Seat moves use separate license-only consent; extended capabilities use extended consent.

Every permission Aristo asks for: what it lets Aristo do, whether it reads or writes, whether it is required, and whether it is granted
Permission	What it lets Aristo do	Reads or writes	Required	State
Reports.Read.All	Copilot adoption Read usage reports to count adoption by team, with at least five people in every named team.	Reads	Required	asked at consent
ReportSettings.Read.All	Name visibility Read whether Microsoft conceals names in usage reports; honor that setting.	Reads	Required	asked at consent
User.Read.All	Departments Read directory profiles to group people by department. Names require the organization’s visibility policy and each person’s choice.	Reads	Required	asked at consent
Organization.Read.All	Licenses Read the organization’s purchased and assigned licenses.	Reads	Required	asked at consent
ServiceMessage.Read.All	Message Center Read the organization’s Message Center announcements.	Reads	Required	asked at consent
CopilotPackages.Read.All	Agent inventory Read the organization’s Copilot agents, so the register lists agents Aristo did not build. It arrives with the core consent and setup is complete without it; the feature also needs Microsoft Agent 365 licensing. Without it, only agents built with Aristo appear on the register.	Reads	Opt-in	asked at consent
LicenseAssignment.ReadWrite.All	Move an approved seat Change license assignments to move a seat ready to activate to a consenting teammate after approval. Without it, Aristo hands your administrator the steps instead of moving the seat.	Writes	Opt-in	asked at consent
AppCatalog.ReadWrite.All	Approved app catalog Read and change the organization’s app catalog. Publishing that Microsoft requires an administrator to perform is handed to that administrator. Without it, an approved agent ends as a package for your administrator to publish.	Writes	Opt-in	asked at consent
TeamsAppInstallation.ReadWriteForUser.All	Approved app installation Install or remove approved Teams apps for people who requested them. Without it, those people install the app themselves.	Writes	Opt-in	asked at consent
GroupMember.Read.All	Approver and leader groups Read membership of the security groups the organization names for access and approvals. Without it, group-based approvals are refused.	Reads	Opt-in	asked at consent
Mail.Read	Optional inbox help Read only mailboxes covered by the organization’s verified Exchange policy, for people who chose inbox help. Without it, there is no inbox help and everything else is unchanged.	Reads	Opt-in	asked at consent
Mail.Send	Operational email Send email as the application. It comes with the extended consent; Aristo sends its operational email from its own mailbox and does not use this permission in your organization. It can send mail and is not a read.	Writes	Opt-in	asked at consent
LicenseAssignment.ReadWrite.All	Optional license writer Separate license-only consent for approved seat moves. It grants no mail or app-installation access. Without it, the move stays off.	Writes	Opt-in	asked at consent
User.Read	Your profile Read the signed-in person’s profile.	Reads	Core consent · delegated	Not checked here
offline_access	Keep your sign-in Maintain access the signed-in person granted without asking them to sign in for each request.	Keeps access	Core consent · delegated	Not checked here
Mail.Read	Your email Read the signed-in person’s email for the help they request.	Reads	Core consent · delegated	Not checked here
Mail.Send	Your email reply Send email as the signed-in person, only when that person presses send.	Writes	Core consent · delegated	Not checked here
Calendars.Read	Your calendar Read the signed-in person’s calendar to prepare for a meeting they ask about.	Reads	Core consent · delegated	Not checked here

One admin consent grants Aristo six Microsoft Graph read permissions across your organization; for a person who uses Aristo, it can also read their mail and calendar and send mail as them, only when they ask. Setup needs five of the six reads; CopilotPackages.Read.All (agent inventory) is optional and comes with the same consent. The same click grants five delegated permissions for the signed-in person: User.Read, offline_access, Mail.Read, Mail.Send and Calendars.Read. Mail is sent only when that person presses send. Writes across your organization need the separate, optional extended consent. The extended consent grants its permissions together; each feature still needs its own approval or choice. An administrator can revoke either consent in Microsoft Entra at any time. 18 permissions: 5 required application reads, 5 delegated permissions (1 write), and 8 opt-in application permissions (5 writes). Counted from Aristo’s own permission list — what it asks for at consent. What your organization has granted is checked separately. Not asked at consent: SecurityEvents.Read.All, which reads Microsoft Secure Score. An administrator grants it in Microsoft Entra to add the security pillar; without it, the score is counted without that pillar.

Aristo · Security review

Organization-wide reads. Aggregate. Revocable.

Everything Aristo reads, why, and its real grant state — the whole security review on one page. Nothing is installed server-side in your tenant; consent is one click by your admin in Microsoft Entra, and revocable there at any time. States shown reflect your tenant the moment it connects.

The exact access — and its real state

Every permission Aristo asks for: what it lets Aristo do, whether it reads or writes, whether it is required, and whether it is granted
Permission	What it lets Aristo do	Reads or writes	Required	State
Reports.Read.All	Copilot adoption Read usage reports to count adoption by team, with at least five people in every named team.	Reads	Required	Not checked
ReportSettings.Read.All	Name visibility Read whether Microsoft conceals names in usage reports; honor that setting.	Reads	Required	Not checked
User.Read.All	Departments Read directory profiles to group people by department. Names require the organization’s visibility policy and each person’s choice.	Reads	Required	Not checked
Organization.Read.All	Licenses Read the organization’s purchased and assigned licenses.	Reads	Required	Not checked
ServiceMessage.Read.All	Message Center Read the organization’s Message Center announcements.	Reads	Required	Not checked
CopilotPackages.Read.All	Agent inventory Read the organization’s Copilot agents, so the register lists agents Aristo did not build. It arrives with the core consent and setup is complete without it; the feature also needs Microsoft Agent 365 licensing. Without it, only agents built with Aristo appear on the register.	Reads	Opt-in	Not checked
LicenseAssignment.ReadWrite.All	Move an approved seat Change license assignments to move a seat ready to activate to a consenting teammate after approval. Without it, Aristo hands your administrator the steps instead of moving the seat.	Writes	Opt-in	Not checked
AppCatalog.ReadWrite.All	Approved app catalog Read and change the organization’s app catalog. Publishing that Microsoft requires an administrator to perform is handed to that administrator. Without it, an approved agent ends as a package for your administrator to publish.	Writes	Opt-in	Not checked
TeamsAppInstallation.ReadWriteForUser.All	Approved app installation Install or remove approved Teams apps for people who requested them. Without it, those people install the app themselves.	Writes	Opt-in	Not checked
GroupMember.Read.All	Approver and leader groups Read membership of the security groups the organization names for access and approvals. Without it, group-based approvals are refused.	Reads	Opt-in	Not checked
Mail.Read	Optional inbox help Read only mailboxes covered by the organization’s verified Exchange policy, for people who chose inbox help. Without it, there is no inbox help and everything else is unchanged.	Reads	Opt-in	Not checked
Mail.Send	Operational email Send email as the application. It comes with the extended consent; Aristo sends its operational email from its own mailbox and does not use this permission in your organization. It can send mail and is not a read.	Writes	Opt-in	Not checked
LicenseAssignment.ReadWrite.All	Optional license writer Separate license-only consent for approved seat moves. It grants no mail or app-installation access. Without it, the move stays off.	Writes	Opt-in	Not checked
User.Read	Your profile Read the signed-in person’s profile.	Reads	Core consent · delegated	Not checked here
offline_access	Keep your sign-in Maintain access the signed-in person granted without asking them to sign in for each request.	Keeps access	Core consent · delegated	Not checked here
Mail.Read	Your email Read the signed-in person’s email for the help they request.	Reads	Core consent · delegated	Not checked here
Mail.Send	Your email reply Send email as the signed-in person, only when that person presses send.	Writes	Core consent · delegated	Not checked here
Calendars.Read	Your calendar Read the signed-in person’s calendar to prepare for a meeting they ask about.	Reads	Core consent · delegated	Not checked here

The extended consent grants its whole set together.

Sign in · Review and grant the admin consent →
Requires a Global Administrator. Entra shows every permission before anything is granted. This one click grants the whole registration, Mail.Send (delegated) included — a send on a person’s own press, not a read.

Supported environments

Environment	State	Plainly
Microsoft 365 commercial cloud	supported today	The Graph usage-report surfaces Aristo reads are fully available.
Display-name concealment tenants	supported — counted mode	Your privacy setting is honored: seats ready to activate are COUNTED but never individually reached.
Multi-geo tenants	supported	Aggregate Graph reads work across geos.
GCC / GCC-High / DoD	roadmap	Government-cloud report APIs differ — we say so honestly rather than half-work. Ask us before piloting there.

Actions and privacy boundaries

Two kinds of write exist, and both are named: the extended consent’s application writes, off until your admin grants that consent and audited when used, and delegated Mail.Send, which sends YOUR draft only on YOUR press. Everything else Aristo emits is a Teams message, or one of the three operational e-mails the trust page names.
Actions on your behalf require your own press. With admin consent, Aristo also acts as the app: Teams messages, the weekly sponsor digest, and a seat move after a leader approves it. Three operational emails are sent as the app: an enabled consumption signal to a named account contact, a sandbox-access notice, and a return-consent challenge. Named department views follow the organization’s visibility policy, each person’s naming choice and the five-person floor; personal activity stays private.
Leader measures describe teams of five or more. The single exception is a named department view under your organization’s named-data contract. Eligible people are included by default unless a privacy exclusion applies; earlier “do not name me” choices remain honored. The five-person floor still applies, and the view shows only a name and cohort membership—never a personal activity ledger, prompts, documents, timeline, or usage ranking.
Never estimate — anything unmeasured is shown as missing, with the exact consent that would light it up.
Never train on your data — your tenant's signals compose your report, nothing else.

The note to IT — ready to paste

Forward this as-is; it carries the access list, the posture, and the consent link.

Subject: Admin consent for Aristo (Copilot adoption measurement)

Hi team,

We are enabling Aristo to measure and grow our Copilot adoption. It needs a one-time admin consent. One click grants everything the app registration declares, so this is the whole of it — the aggregate Microsoft Graph reads below, plus Mail.Send (delegated), which is not a read: it acts as the signed-in person, on that person’s own press. Entra lists every one before anything is granted:
• Reports.Read.All — Read usage reports to count adoption by team, with at least five people in every named team.
• ReportSettings.Read.All — Read whether Microsoft conceals names in usage reports; honor that setting.
• User.Read.All — Read directory profiles to group people by department. Names require the organization’s visibility policy and each person’s choice.
• Organization.Read.All — Read the organization’s purchased and assigned licenses.
• ServiceMessage.Read.All — Read the organization’s Message Center announcements.
• CopilotPackages.Read.All — Read the organization’s Copilot agents, so the register lists agents Aristo did not build. It arrives with the core consent and setup is complete without it; the feature also needs Microsoft Agent 365 licensing. Without it, only agents built with Aristo appear on the register.
• Delegated: User.Read, offline_access, Mail.Read, Mail.Send, Calendars.Read — pre-consented for our people by this same click. They act AS the signed-in person, only on that person’s own press, never on a schedule.

Nothing is installed in our tenant. Access is revocable in Microsoft Entra at any time. Security review page (posture + exact scopes + live grant state): https://aristo.phoenixhalo.com/trust/review

Consent link (Global Administrator, one click):
https://login.microsoftonline.com/organizations/adminconsent?client_id=bca15923-f255-434d-aa28-9f24712efa0e&redirect_uri=https%3A%2F%2Faristo.phoenixhalo.com%2Fauth%2Fcallback&state=eyJ0aWQiOiJvcmdhbml6YXRpb25zIiwicmVnIjoiY29yZSIsIm4iOiJjd3dnVkttSEp2TlEiLCJ0eXAiOiJhYyIsImV4cCI6MTc5MjcyMzYwNjE5MX0.hllxW5cYqwKhQfAuHXmcCiOGQMwRNVP2rnwaAGHhy7E

Thank you!

· Print / save as PDF · The full compliance pack (PDF) → · The Frontier Firm Report →

A person answers within one business day — email us · or say help, stop, resume or tip to Aristo in Teams.