How Mosaic uses Microsoft access
A plain-language permission ledger for users and organization administrators, including consent and revocation paths.
The exact request
Mosaic currently requests openid, profile, email, and delegated User.Read during interactive Microsoft sign-in. These scopes identify the signed-in person, resolve their Mosaic account, and read that person's basic profile and 48-pixel profile image.
The request is delegated, not application-only. Mosaic does not configure a background Microsoft Graph job, does not explicitly request offline_access, and the reviewed application tables do not contain Microsoft access-token or refresh-token columns.
What Mosaic does not request
- Mail or mailbox content
- Calendars
- OneDrive or SharePoint files
- Teams chats, channels, meetings, or presence
- Contacts, groups, or group membership
- Other users' or tenant-wide directory profiles
- Application-only access without a signed-in user
- Explicit offline_access for background access
Administrator consent
Microsoft currently classifies delegated User.Read as not requiring administrator consent by default. A tenant can still require approval because of its user-consent, app-risk, assignment, or Conditional Access policies. Mosaic does not bypass those policies.
Tenant-wide admin consent for this delegated set can remove repeated consent prompts for approved scopes. It does not turn them into application permissions or give Mosaic access to every user's profile without a signed-in user.
What administrators should review
- The Mosaic app name and publisher shown by Microsoft
- The redirect URI and delegated permission list
- User assignment and the tenant's consent and access policies
- Whether the production registration and publisher status match the organization's expectations
Revocation and access changes
A user can revoke consent through Microsoft account controls, subject to tenant policy. A tenant administrator can revoke consent, unassign users, restrict assignment, disable the Mosaic enterprise application, or remove it through Microsoft Entra controls.
Mosaic also applies local account and membership checks after Microsoft authentication. Revoking Microsoft consent does not itself delete Mosaic account or project data; use the privacy or account-deletion paths for those requests.
Publisher verification status
Mosaic does not yet claim Microsoft publisher verification. Partner Center association, live registration review, consent evidence, secret rotation, and an external-tenant sign-in matrix remain human gates.
If Microsoft later shows Mosaic Screens LLC as a verified publisher, that would indicate publisher identity assurance. It would not be a security certification, SOC 2 report, Microsoft 365 App Certification, compliance determination, or endorsement.
Change history
- Draft 0.1 ·
Initial fact-checked publication draft. It is not effective and has not been approved as a legal or contractual commitment.