Skip to content

Permissions and coverage

Two public files say what Ojja reads. The permission manifest: what Ojja requests, from whom, and why. The coverage: what is read, tool by tool, under which regime and at what pace. The site, the workspace and the ready-made email for your administrator read the same files.

The manifest #

  • The application that reads, vendor by vendor (for Microsoft 365: Ojja Reader), and its regime.
  • Each permission, with what it reads and why, and the use that requests it: the readout, Ojja Watch, or both.
  • The directory roles, optional, with their fallback.
  • The closed list of endpoints called.

A new version of the Manifest that adds a permission requires a new authorization from the Administrator.

Ojja Reader

We never touch it

Some reads go through one line per person: the directory, the Copilot usage report, the consents employees have given to an app, the sign-in logs. The identifier is hashed when read; only totals by plan, by app and by department are kept.

When Ojja Watch is opened, with the AI Reader role, your agent inventory is read too: each agent's creator and owner are hashed when read, then forgotten.

  • Organization.Read.All · Free readout · Ojja Watch: Subscriptions and the organization's identity. Read the subscriptions and the organization's identity, that is, what you pay for.
  • User.Read.All · Free readout · Ojja Watch: Accounts and assigned licenses, with their department; each account's identifier is hashed on reading and never kept. Count assigned licenses by SKU and by department, without keeping a single line per person.
  • ServiceMessage.Read.All · Free readout · Ojja Watch: Microsoft's announcements to your administrator (Message Center). Read the announcements Microsoft publishes to your administrator, to know what turns on without a decision on your part.
  • Reports.Read.All · Free readout · Ojja Watch: Microsoft 365 Copilot usage, counted by application and by department. Count how many people use Microsoft 365 Copilot, by application and by department, without keeping a single line per person.
  • Application.Read.All · Free readout · Ojja Watch: Applications in your tenant and the consents granted to them. List the applications in your tenant and the consents granted to them, with the data they reach.
  • AuditLog.Read.All · Free readout · Ojja Watch: Sign-in logs only, aggregated by application and by department. Count sign-ins to applications over 28 days, by application and by department, without keeping a single line per person.
  • AI Reader (optional) · Ojja Watch: Inventory of your agents (Copilot Studio, Agent Builder). CSV export of the inventory, provided by your administrator; without either, agents are marked “not read”.

Endpoints

  • GET https://graph.microsoft.com/v1.0/subscribedSkus
  • GET https://graph.microsoft.com/v1.0/users
  • GET https://graph.microsoft.com/v1.0/directory/subscriptions
  • GET https://graph.microsoft.com/v1.0/admin/serviceAnnouncement/messages
  • GET https://graph.microsoft.com/v1.0/organization
  • GET https://graph.microsoft.com/v1.0/copilot/reports/getMicrosoft365CopilotUsageUserDetail(period='D28')
  • GET https://graph.microsoft.com/v1.0/copilot/reports/getMicrosoft365CopilotUsageUserDetail(period='D180')
  • GET https://graph.microsoft.com/v1.0/servicePrincipals
  • GET https://graph.microsoft.com/v1.0/applications
  • GET https://graph.microsoft.com/v1.0/oauth2PermissionGrants
  • GET https://graph.microsoft.com/v1.0/auditLogs/signIns
  • POST https://api.powerplatform.com/resourcequery/resources/query · AI Reader

Manifest v1.1, October 11, 2026

The coverage #

  • Each tool, with its status: “read from the free readout”, “read with Ojja Watch” or “declared”.
  • What is read, the fallback when a read is not possible, and the reading regime.
  • The reading pace of the five alert events: “read every day”, “read every week” or “on each publication”.

The regime is shown tool by tool, before authorization and on the trust page. In both cases: we read registers and configurations, never your content.

What Ojja does not read yet is declared, and each line then carries the mention “declared”.

  • Microsoft 365

    read from the free readout

    We never touch it

    • Subscriptions and the organization's identity
    • Accounts and assigned licenses, with their department; each account's identifier is hashed on reading and never kept
    • Microsoft's announcements to your administrator (Message Center)
    • Microsoft 365 Copilot usage, counted by application and by department
    • Applications in your tenant and the consents granted to them
    • Sign-in logs only, aggregated by application and by department
    New AI application connected:
    read every day
    Usage billing turned on:
    read every week
    Vendor terms changed:
    on each publication
    New model behind a feature:
    read every day
    New data access:
    read every day

    Console export of the usage report, provided by your administrator

  • Copilot Studio and Agent Builder agents

    read with Ojja Watch

    We never touch it

    • Inventory of your agents (Copilot Studio, Agent Builder)
    New AI application connected:
    read every week
    Usage billing turned on:
    read every week
    Vendor terms changed:
    on each publication
    New model behind a feature:
    read every week
    New data access:
    read every week

    CSV export of the inventory, provided by your administrator; without either, agents are marked “not read”.

The two files and their JSON schemas (in French): permission-manifest.json, permission-manifest.schema.json, coverage.json, coverage.schema.json.