Permissions
In order to work, Pistachio requires certain permissions to access your Microsoft Entra tenant. These permissions are granted to the Pistachio Microsoft application as part of the onboarding process using the OAuth 2.0 client credentials flow. This page describes what each permission is, why it is required, and how the data is used.
Sign in and read user profile
This is the delegated User.Read permission in Microsoft. It enables users to log in to Pistachio using their Microsoft accounts and grants Pistachio access to their basic information, including their name.
Read all users’ full profiles
This is the application User.Read.All permission in Microsoft. It allows Pistachio to read user profile data. This is needed so that Pistachio can get information about each user that should receive a license. The information Pistachio accesses includes the user’s ID, display name, status (enabled / disabled), department, given name, surname, job title, mobile phone number, email address, country, location, and photo. This data is used to show admins in Pistachio relevant information and to improve the targeting of simulated attacks.
Pistachio only stores this data for users that are licensed in Pistachio, i.e. those users that belong to the “pistachio-standard” group in Active Directory.
Read directory data
This is the application Directory.Read.All permission in Microsoft. It allows Pistachio to read data about groups without requiring a logged in user. It also grants Pistachio access to basic information such as the organization’s name and preferred language.
Read activity data for your organization
This is the application ActivityFeed.Read permission in Microsoft. It is only needed for Presence customers. It allows Pistachio to retrieve information about user, admin, system, and policy actions and events from Office 365 and Microsoft Entra activity logs. We use this data to identify insider threats in your organization.
Read and write mail in all mailboxes
This is the application Mail.ReadWrite permission in Microsoft. It is required for both products, Presence and Practice. It allows Pistachio to create, read, update, and delete mail in all mailboxes. However, it does not grant Pistachio the ability to send emails. This permission is required to allow Pistachio to send email attacks to users as well as inject canaries in an admin's sent mailbox.
Pistachio uses the “Create mail in mail folder” API request to send users email attacks. This endpoint requires a permission called Mail.ReadWrite, even though it only involves writing emails and not reading them. We believe that the more appropriate permission for this action would be Mail.Write, as we don't need or want the ability to read users' emails. We are actively advocating to Microsoft to modify the permission requirement to Mail.Write.
Until Microsoft adds support for a Mail.Write permission, we will need to continue to request Mail.ReadWrite. However, it's important to note that Pistachio does not read your emails, nor does it have any code that allows it to do so. We have also implemented multiple security measures to ensure that no one within Pistachio accesses your emails.
If you would like to help us to get Microsoft to make a change, please contact us at contact@pistachioapp.com. Any help would be greatly appreciated.
In order to work, Pistachio requires certain permissions to access your Microsoft Entra tenant. These permissions are granted to the Pistachio Microsoft application as part of the onboarding process using the OAuth 2.0 client credentials flow. This page describes what each permission is, why it is required, and how the data is used.
Sign in and read user profile
This is the delegated User.Read permission in Microsoft. It enables users to log in to Pistachio using their Microsoft accounts and grants Pistachio access to their basic information, including their name.
Read all users’ full profiles
This is the application User.Read.All permission in Microsoft. It allows Pistachio to read user profile data. This is needed so that Pistachio can get information about each user that should receive a license. The information Pistachio accesses includes the user’s ID, display name, status (enabled / disabled), department, given name, surname, job title, mobile phone number, email address, country, location, and photo. This data is used to show admins in Pistachio relevant information and to improve the targeting of simulated attacks.
Pistachio only stores this data for users that are licensed in Pistachio, i.e. those users that belong to the “pistachio-standard” group in Active Directory.
Read directory data
This is the application Directory.Read.All permission in Microsoft. It allows Pistachio to read data about groups without requiring a logged in user. It also grants Pistachio access to basic information such as the organization’s name and preferred language.
Read activity data for your organization
This is the application ActivityFeed.Read permission in Microsoft. It is only needed for Presence customers. It is not requested or granted for customers who use Practice only. It allows Pistachio to retrieve information about user, admin, system, and policy actions and events from Office 365 and Microsoft Entra activity logs. We use this data to identify insider threats and other security risks in your organization, including low-risk events such as company files sent to personal email addresses or repeated failed sign-ins. Where you configure email recipient labels, this includes the recipient addresses of the emails concerned.
Read and write mail in all mailboxes
This is the application Mail.ReadWrite permission in Microsoft. It is required for both products, Presence and Practice. It allows Pistachio to create, read, update, and delete mail in all mailboxes. However, it does not grant Pistachio the ability to send emails. This permission is required to allow Pistachio to send email attacks to users as well as inject canaries in an admin's sent mailbox.
Pistachio uses the “Create mail in mail folder” API request to send users email attacks. Simulations are placed directly in users' mailboxes through the Microsoft Graph API and are not sent over SMTP, so no changes to spam filters, transport rules or Microsoft Defender are needed. This endpoint requires a permission called Mail.ReadWrite, even though it only involves writing emails and not reading them. We believe that the more appropriate permission for this action would be Mail.Write, as we don't need or want the ability to read users' emails. We are actively advocating to Microsoft to modify the permission requirement to Mail.Write.
Until Microsoft adds support for a Mail.Write permission, we will need to continue to request Mail.ReadWrite. However, it's important to note that Pistachio does not read your emails under this permission, nor does it have any code that allows it to do so. We have also implemented multiple security measures to ensure that no one within Pistachio accesses your emails.
If you would like to help us to get Microsoft to make a change, please contact us at contact@pistachioapp.com. Any help would be greatly appreciated.
Reporting button (Outlook add-in)
Practice includes a reporting button, an Outlook add-in that lets users report suspicious emails. The add-in only works on the email the user has open, and its delegated permissions act on behalf of the signed-in user, within their existing mailbox rights. It uses the following permissions:
- openid (delegated): signs the user in with their Microsoft work account and lets Pistachio verify their identity.
- profile (delegated): provides basic identity information, such as the user's name and username, during sign-in.
- User.Read (delegated): reads the user's account ID and email address to identify who submitted the report.
- Mail.ReadWrite.Shared (delegated): reads the reported email, attaches it to the report and moves it to Junk.
- Mail.Send.Shared (delegated): sends the report from the user's own mailbox to your designated reporting address.
- ThreatSubmission.Read.All (application, read-only, requires administrator approval): reads your Microsoft Defender submission policies to find your reporting mailbox address. It cannot create or change submissions or policies.
Admin access
Admin access to Pistachio is given through a designated Microsoft Entra ID group in your tenant, pistachio-admin.
Global Administrators get temporary admin access for the first 24 hours so they can complete the initial setup. After that, a Global Administrator only keeps access if they are also a member of one of the Pistachio groups (pistachio-admin, pistachio-sat or pistachio-itd). Being a Global Administrator does not by itself give lasting access to Pistachio.
Access tokens that Microsoft issues to Pistachio for your organization are never stored. They are held only in memory and are regenerated whenever the application restarts.
In order to work, Pistachio requires certain permissions to access your Microsoft Entra tenant. These permissions are granted to the Pistachio Microsoft application as part of the onboarding process using the OAuth 2.0 client credentials flow. This page describes what each permission is, why it is required, and how the data is used.
Sign in and read user profile
This is the delegated User.Read permission in Microsoft. It enables users to log in to Pistachio using their Microsoft accounts and grants Pistachio access to their basic information, including their name.
Read all users’ full profiles
This is the application User.Read.All permission in Microsoft. It allows Pistachio to read user profile data. This is needed so that Pistachio can get information about each user that should receive a license. The information Pistachio accesses includes the user’s ID, display name, status (enabled / disabled), department, given name, surname, job title, mobile phone number, email address, country, location, and photo. This data is used to show admins in Pistachio relevant information and to improve the targeting of simulated attacks.
Pistachio only stores this data for users that are licensed in Pistachio, i.e. those users that belong to the “pistachio-standard” group in Active Directory.
Read directory data
This is the application Directory.Read.All permission in Microsoft. It allows Pistachio to read data about groups without requiring a logged in user. It also grants Pistachio access to basic information such as the organization’s name and preferred language.
Read activity data for your organization
This is the application ActivityFeed.Read permission in Microsoft. It is only needed for Presence customers. It allows Pistachio to retrieve information about user, admin, system, and policy actions and events from Office 365 and Microsoft Entra activity logs. We use this data to identify insider threats in your organization.
Read and write mail in all mailboxes
This is the application Mail.ReadWrite permission in Microsoft. It is required for both products, Presence and Practice. It allows Pistachio to create, read, update, and delete mail in all mailboxes. However, it does not grant Pistachio the ability to send emails. This permission is required to allow Pistachio to send email attacks to users as well as inject canaries in an admin's sent mailbox.
Pistachio uses the “Create mail in mail folder” API request to send users email attacks. This endpoint requires a permission called Mail.ReadWrite, even though it only involves writing emails and not reading them. We believe that the more appropriate permission for this action would be Mail.Write, as we don't need or want the ability to read users' emails. We are actively advocating to Microsoft to modify the permission requirement to Mail.Write.
Until Microsoft adds support for a Mail.Write permission, we will need to continue to request Mail.ReadWrite. However, it's important to note that Pistachio does not read your emails, nor does it have any code that allows it to do so. We have also implemented multiple security measures to ensure that no one within Pistachio accesses your emails.
If you would like to help us to get Microsoft to make a change, please contact us at contact@pistachioapp.com. Any help would be greatly appreciated.
In order to work, Pistachio requires certain permissions to access your Microsoft Entra tenant. These permissions are granted to the Pistachio Microsoft application as part of the onboarding process using the OAuth 2.0 client credentials flow. This page describes what each permission is, why it is required, and how the data is used.
Sign in and read user profile
This is the delegated User.Read permission in Microsoft. It enables users to log in to Pistachio using their Microsoft accounts and grants Pistachio access to their basic information, including their name.
Read all users’ full profiles
This is the application User.Read.All permission in Microsoft. It allows Pistachio to read user profile data. This is needed so that Pistachio can get information about each user that should receive a license. The information Pistachio accesses includes the user’s ID, display name, status (enabled / disabled), department, given name, surname, job title, mobile phone number, email address, country, location, and photo. This data is used to show admins in Pistachio relevant information and to improve the targeting of simulated attacks.
Pistachio only stores this data for users that are licensed in Pistachio, i.e. those users that belong to the “pistachio-standard” group in Active Directory.
Read directory data
This is the application Directory.Read.All permission in Microsoft. It allows Pistachio to read data about groups without requiring a logged in user. It also grants Pistachio access to basic information such as the organization’s name and preferred language.
Read activity data for your organization
This is the application ActivityFeed.Read permission in Microsoft. It is only needed for Presence customers. It allows Pistachio to retrieve information about user, admin, system, and policy actions and events from Office 365 and Microsoft Entra activity logs. We use this data to identify insider threats in your organization.
Read and write mail in all mailboxes
This is the application Mail.ReadWrite permission in Microsoft. It is only needed for Practice customers. It allows Pistachio to create, read, update, and delete mail in all mailboxes. However, it does not grant Pistachio the ability to send emails. This permission is required to allow Pistachio to send email attacks to users.
Pistachio uses the “Create mail in mail folder” API request to send users email attacks. This endpoint requires a permission called Mail.ReadWrite, even though it only involves writing emails and not reading them. We believe that the more appropriate permission for this action would be Mail.Write, as we don't need or want the ability to read users' emails. We are actively advocating to Microsoft to modify the permission requirement to Mail.Write.
Until Microsoft adds support for a Mail.Write permission, we will need to continue to request Mail.ReadWrite. However, it's important to note that Pistachio does not read your emails, nor does it have any code that allows it to do so. We have also implemented multiple security measures to ensure that no one within Pistachio accesses your emails.
If you would like to help us to get Microsoft to make a change, please contact us at contact@pistachioapp.com. Any help would be greatly appreciated.
In order to work, Pistachio requires certain permissions to access your Microsoft Active Directory tenant. These permissions are granted to the Pistachio Microsoft application as part of the onboarding process using the OAuth 2.0 client credentials flow. This page describes what each permission is, why it is required, and how the data is used.
Sign in and read user profile
This is the delegated User.Read permission in Microsoft. It enables users to log in to Pistachio using their Microsoft accounts and grants Pistachio access to their basic information, including their name.
Read all users’ full profiles
This is the application User.Read.All permission in Microsoft. It allows Pistachio to read user profile data. This is needed so that Pistachio can get information about each user that should receive a license. The information Pistachio accesses includes the user’s ID, display name, status (enabled / disabled), department, given name, surname, job title, mobile phone number, email address, country, location, and photo. This data is used to show admins in Pistachio relevant information and to improve the targeting of simulated attacks.
Pistachio only stores this data for users that are licensed in Pistachio, i.e. those users that belong to the “pistachio-standard” group in Active Directory.
Read directory data
This is the application Directory.Read.All permission in Microsoft. It allows Pistachio to read data about groups without requiring a logged in user. It also grants Pistachio access to basic information such as the organization’s name and preferred language.
Read and write mail in all mailboxes
This is the application Mail.ReadWrite permission in Microsoft. It allows Pistachio to create, read, update, and delete mail in all mailboxes. However, it does not grant Pistachio the ability to send emails. This permission is required to allow Pistachio to send email attacks to users.
Pistachio uses the “Create mail in mail folder” API request to send users email attacks. This endpoint requires a permission called Mail.ReadWrite, even though it only involves writing emails and not reading them. We believe that the more appropriate permission for this action would be Mail.Write, as we don't need or want the ability to read users' emails. We are actively advocating to Microsoft to modify the permission requirement to Mail.Write.
Until Microsoft adds support for a Mail.Write permission, we will need to continue to request Mail.ReadWrite. However, it's important to note that Pistachio does not read your emails, nor does it have any code that allows it to do so. We have also implemented multiple security measures to ensure that no one within Pistachio accesses your emails.
If you would like to help us to get Microsoft to make a change, please contact us at contact@pistachioapp.com. Any help would be greatly appreciated.
Current version: