Which permissions does Ojja request, and why?
In two lines #
Six Microsoft Graph application permissions, read-only, each with its reason written in the published manifest. The same list appears on ojja.ai and in your workspace.
The steps #
- In your workspace, open “Connections and access”, “The requested permissions” block: each permission, and its “Why” column.
- In the “Connected” block, the “Manifest version” field says which version your administrator accepted.
- On ojja.ai: the full manifest, with the closed list of endpoints, at /en/trust#manifeste; the readout permissions at /en/readout#autorisations.
The manifest, line by line:
| Permission | What it reads | Why |
|---|---|---|
| Organization.Read.All | Subscriptions and the organization's identity | Read the subscriptions and the organization's identity, that is, what you pay for. |
| User.Read.All | Accounts and assigned licenses, with their department; each account's identifier is hashed on reading and never kept | Count assigned licenses by SKU and by department, without keeping a single line per person. |
| ServiceMessage.Read.All | Microsoft's announcements to your administrator (Message Center) | Read the announcements Microsoft publishes to your administrator, to know what turns on without a decision on your part. |
| Reports.Read.All | Microsoft 365 Copilot usage, counted by application and by department | Count how many people use Microsoft 365 Copilot, by application and by department, without keeping a single line per person. |
| Application.Read.All | Applications in your tenant and the consents granted to them | List the applications in your tenant and the consents granted to them, with the data they reach. |
| AuditLog.Read.All | Sign-in logs only, aggregated by application and by department | Count sign-ins to applications over 28 days, by application and by department, without keeping a single line per person. |
Some reads go through one line per person: the directory, the Copilot usage report, the consents employees have given to an app, the sign-in logs. The identifier is hashed when read; only totals by plan, by app and by department are kept.
For Ojja Watch only, the AI Reader directory role, optional. When Ojja Watch is opened, with the AI Reader role, your agent inventory is read too: each agent's creator and owner are hashed when read, then forgotten. Without this role: CSV export of the inventory, provided by your administrator; without either, agents are marked “not read”.
A new version of the Manifest that adds a permission requires a new authorization from the Administrator.
On the Arvenne example #
On the Arvenne example, the reading finds 37 applications and 14 AI features.
What Ojja does not do #
Ojja requests no write permission, and no permission that opens the content of your emails, documents or conversations.