Microsoft 365 Copilot seats
Copilot licenses and each holder's last use. Each holder is a code, not a name. The approval asks to read usage reports, licenses and users. Never a document, prompt, chat or name.
Access
- Kind
- Sign in on the vendor's page; nothing typed here
- What to give
- App registration, client credentials
- Why that one
- An Entra app registration with three read-only application permissions. Valistry reads the license list and the Copilot usage report; never a document, never a prompt, never a chat.
What it attributes on its own
- From the source
- seat holder (hashed); seat-days in the period; whether Microsoft saw activity in this period, and in which apps; the SKU and how many units the tenant consumes
- Needs a rule or a trace
- tokens and models per seat — Microsoft reports activity, not usage; the charge itself: Valistry uses seats × the published or contract price; when a seat was assigned, which the license does not carry; outcome
The addresses it calls
- https://login.microsoftonline.com
- https://graph.microsoft.com/v1.0/
- https://reports.office.com
Valistry calls only these addresses. It blocks any other call and logs every call.
Connecting it
- Register the app. Click New registration, or open your Valistry app. Then Register. Open ↗
- Make its password. In the app: Certificates & secrets → New client secret → Add. Open ↗
- Add three Microsoft Graph permissions. In the app: API permissions → Add a permission → Microsoft Graph → Application permissions Open ↗
If reports hide names, holders and activity cannot be joined, and every seat is marked unknown. To show them: Microsoft 365 admin center → Settings → Org settings → Services → Reports, tick Display concealed user, group, and site names in all reports. Valistry stores hashes either way.