Approving aimo Connectors for your organisation

Bosphorus can connect a person’s own OneDrive to aimo, so the assistant can list, search, read and save files there as that person. A Bosphorus installation does this through one Microsoft Entra app, named aimo Connectors unless the operator chose another name.

When the person’s work account belongs to your organisation rather than the one that runs the installation, Microsoft asks your administrator to approve that app before anyone can connect. This article is for that administrator. It explains what the app asks for, how to approve it once, how to limit it to some people, and how to withdraw it. It was checked against the running product on 12 October 2026.

Who does what

Approving the app in your tenant does not, on its own, let anyone in. A person also needs a Bosphorus account and a connector profile that offers OneDrive.

What the app asks for

The app is multi-tenant: it accepts work or school accounts from any organisation, and personal Microsoft accounts. It holds delegated permissions only. It acts as the signed-in person and reaches only what that person can already open. It holds no application permissions, so it has no access of its own without a person behind it.

Files.ReadWrite does not reach other people’s drives or SharePoint sites. That would need Files.ReadWrite.All or a Sites permission, and the app requests neither. aimo also offers no tool that deletes a file or creates a sharing link, so nothing can be removed or shared out through it.

Why your people cannot approve it themselves

Under Microsoft’s default and recommended consent settings, ordinary users cannot approve a multi-tenant app whose publisher is not verified, and aimo Connectors is not publisher-verified. When one of your people presses Connect, Microsoft shows Need admin approval and stops. An administrator approves it once, for the whole tenant or for the people you choose.

How to approve it

1. Get the approval link from the Bosphorus administrator. They build it for your tenant on the console’s Connectors page and send it to you together with the app’s client ID. Before opening it, check its shape (shown here unencoded):

   https://login.microsoftonline.com/<your tenant>/v2.0/adminconsent?client_id=<client ID>&scope=openid profile email offline_access https://graph.microsoft.com/User.Read https://graph.microsoft.com/Files.ReadWrite&redirect_uri=https://<their console>/auth/connectors/callback
   

   The host is Microsoft’s own sign-in host, the tenant is yours, the client ID is the one you were given, and the scopes are exactly the five above. A link with any other host, client ID or scope is not this app.

2. Open it signed in as a Global Administrator or Privileged Role Administrator. Microsoft lists the permissions and asks you to accept on behalf of your organisation. Accept only if they match the table above.

3. Read the confirmation. Microsoft sends you back to the installation’s console, which shows aimo Connectors is approved for your organisation. The approval is recorded at Microsoft as soon as you accept; that page only confirms it.

4. Check it in your tenant. In the Microsoft Entra admin center, open Enterprise applications → aimo Connectors → Permissions. Under Admin consent you should see the delegated Microsoft Graph permissions above and nothing else.

5. Tell your people. They connect from the console’s My variables page, under Connected services, signing in with their work account.

Approving it for some people only

1. Approve the app as above, so nobody meets a consent prompt.
2. In Enterprise applications → aimo Connectors → Properties, set Assignment required? to Yes and save.
3. Under Users and groups, add the people or groups who may connect. Microsoft refuses everyone else at sign-in.

If your tenant uses the admin consent workflow, a person can also request approval from the Need admin approval screen, and you approve it under Admin consent requests.

Conditional Access

• Your Conditional Access policies apply when a person connects, as for any other app.
• After that, the connection is used from the installation’s servers, not from the person’s device. A policy that requires a compliant or hybrid-joined device, or a trusted location, for every cloud app will block it. Exclude aimo Connectors from such a policy, or keep it and accept that OneDrive will not work in aimo.
• A sign-in frequency policy ends the connection on that schedule. aimo then tells the person to reconnect, and they do so from the same page.

What the installation keeps

• For each connected person, the refresh token Microsoft issued for this app. It is kept in that person’s own encrypted vault folder and used only for requests that person makes in aimo. Each request gets a short-lived access token; the file tools never see the refresh token.
• Which account the person connected, and when. No password ever reaches the installation.
• An audit record of every file action aimo performs, naming the person and the tool.
• No copy of the drive. A file is read when the person’s request needs it.

Withdrawing access

• One person: they press Disconnect on My variables, which destroys the stored token at once. They can also remove the app at myapps.microsoft.com, and you can revoke that user’s sessions in Microsoft Entra.
• Your whole organisation: delete aimo Connectors under Enterprise applications. The approval is removed and every connection from your tenant stops within the hour, once the short-lived access token already issued expires. After that, aimo tells each person that OneDrive needs reconnecting, which needs your approval again.

If someone still cannot connect

When you contact the installation’s administrator, give them your tenant ID and the address of the person who cannot connect, so they can match it to Microsoft’s sign-in logs.