I am an administrator: how do I give Ojja consent?

In two lines #

Open the consent link you received, sign in with an account authorized to consent for the whole organization, read the permissions and accept on the Microsoft screen. No delegated permissions. No write permissions. No directory role is requested for the readout.

The steps #

1. Open the consent link that was sent to you. It is specific to your organization's workspace and valid for seven days.
2. Sign in with an account authorized to consent for the whole organization.
3. Read the request from the “Ojja Reader” application: six application permissions, read-only (Organization.Read.All, User.Read.All, ServiceMessage.Read.All, Reports.Read.All, Application.Read.All, AuditLog.Read.All). What each one reads and why: see The requested permissions.
4. Accept. The return screen shows: “Consent received. The permissions test follows, then the first readout.”
5. Do you administer on behalf of a client? Consent is given in your client's tenant, not in yours.
6. Do you have an account in your organization's Ojja workspace? In “Connections and access”, “Ask my admin” block, “Open Microsoft's consent screen” opens the same screen.

The possible return messages:

• “This consent link has already been used.”
• “This consent link has expired. The Connections page gives you a new one.”
• “This tenant is already attached to another Ojja workspace.” Nothing is read from this workspace; ask for an invitation from the person who opened your organization's workspace.
• “Consent not given. Nothing is read.”

On the Arvenne example #

At Arvenne, a fictional company of 412 Microsoft 365 accounts, the four readings are done: licenses, applications, settings and usage reports.

What Ojja does not do #

Ojja never writes to your tenant and changes no setting in it. When Watch is opened, Ojja also requests the AI Reader directory role, for the agent inventory. It is not requested for the readout.

The method #

We never touch it; the full manifest: /en/trust#manifeste.