Connectors - Technical Info

Overview

Ari Cloud connects to Microsoft 365 so Ari can read and act on a user's contacts, calendar, email, Teams chat, and files. Each connector is its own Microsoft Graph integration, authorized individually and revocable individually — connecting one (e.g. Calendar) does not grant access to the others. Connectors can be turned on or off individually from the Connectors settings screen in Ari Cloud at any time.

Azure AD App Registration & Permissions

Client ID: 6ae66605-393b-4c6c-924b-f50b2022cb87

All permissions are delegated-style, meaning they operate within the signed-in user's context — Ari Cloud only ever acts as that specific user, never as an application with standing access to the whole tenant.

Backend

All four connectors run entirely server-side inside the ari backend — never on-device. Each connector authenticates through its own Auth0 connection (ms-graph-contacts, ms-graph-calendar, ms-graph-emails, ms-graph-teams), which exchanges a federated token via Auth0 Token Vault for a Microsoft Graph access token scoped to just that connector's permissions. Every connector calls Microsoft Graph through one shared Graph client, hitting the v1.0 Graph API — no beta endpoints are in use anywhere.

Required Permissions & Purposes

Ari Cloud has four official connectors at the time of writing, with some still to be integrated into the Ari on-device client. A user can connect any combination of them; each requests only the scopes listed for it.

Microsoft Contacts Connector

Permission	Endpoint(s) called	Reason Why
https://graph.microsoft.com/openid, .../profile, .../email, .../offline_access	Not a Graph API call — identity/sign-in scopes only	Standard sign-in, plus keeping the connection active without repeatedly re-prompting the user to log in
https://graph.microsoft.com/User.Read	Not independently called by this connector	Requested as a baseline identity scope
https://graph.microsoft.com/User.ReadBasic.All	GET /v1.0/users	Read basic profile info and photos for other people in the org directory — powers the device contact list, including coworkers' profile photos
https://graph.microsoft.com/People.Read	POST /v1.0/search/query — Microsoft Search API person lookup	Resolve people the user frequently interacts with, so Ari can match names to the right person
https://graph.microsoft.com/Contacts.Read	Not currently called	Requested at connection time, for the personal-contacts endpoint (/me/contacts)

What it's useful for: looking people up by voice, hands-free. Read-only — Ari can find and describe a contact, but can't add, edit, or delete one.

"Who's Sarah Chen in my org?"
"Look up Dave from Engineering."

Microsoft Outlook Calendar Connector

Permission	Endpoint(s) called	Reason Why
https://graph.microsoft.com/openid, .../profile, .../email, .../offline_access	Not a Graph API call — identity/sign-in scopes only	Standard sign-in and connection refresh
https://graph.microsoft.com/User.Read	Not independently called by this connector	Requested as a baseline identity scope
https://graph.microsoft.com/Contacts.Read, https://graph.microsoft.com/People.Read	Not independently called by this connector	Requested to resolve meeting attendees to names
https://graph.microsoft.com/Calendars.ReadWrite	GET /v1.0/me/calendarView GET /v1.0/me/events/{id} POST /v1.0/me/events PATCH /v1.0/me/events/{id}	Read the user's calendar and create or update events on their behalf. No DELETE call exists — see the note below the examples.

What it's useful for: checking your schedule and booking or adjusting meetings without touching a screen.

"What's on my calendar this afternoon?"
"Schedule a 30-minute sync with Dave tomorrow at 2pm."
"Move my 3pm to 4pm."

Ari can create and update events, but cannot cancel or delete a calendar event at the time of writing.

Microsoft Outlook Email Connector

Permission	Endpoint(s) called	Reason Why
https://graph.microsoft.com/openid, .../profile, .../email, .../offline_access	Not a Graph API call — identity/sign-in scopes only	Standard sign-in and connection refresh
https://graph.microsoft.com/User.Read	Not independently called by this connector	Requested as a baseline identity scope
https://graph.microsoft.com/Contacts.Read, https://graph.microsoft.com/People.Read	Not independently called by this connector	Requested to resolve email recipients to names
https://graph.microsoft.com/Mail.ReadWrite	GET /v1.0/me/messages/{id} GET /v1.0/me/messages GET /v1.0/me/mailFolders GET /v1.0/me/mailFolders/{id}/messages POST /v1.0/me/messages PATCH /v1.0/me/messages/{id} POST /v1.0/me/messages/{id}/move DELETE /v1.0/me/messages/{id}	Read, draft, organize, and delete the user's email
https://graph.microsoft.com/Mail.Send	POST /v1.0/me/messages/{id}/send POST /v1.0/me/sendMail	Send email on the user's behalf

What it's useful for: reading, drafting, and replying to email hands-free — This is the most feature-rich connector: full read, draft, send, reply, forward, mark-read, and delete each with associated guardrails in place.

"Read me my latest email from IT."
"Draft a reply saying I'll be there."
"Forward that to Dave."
"Mark it as read."

Ari always drafts first and asks you to confirm before actually sending — it never sends an email without your explicit approval.

Microsoft Teams Connector

Permission	Endpoint(s) called	Reason Why
https://graph.microsoft.com/openid, .../profile, .../email, .../offline_access	Not a Graph API call — identity/sign-in scopes only	Standard sign-in and connection refresh
https://graph.microsoft.com/User.Read	Not independently called by this connector	Requested as a baseline identity scope
https://graph.microsoft.com/Contacts.Read, https://graph.microsoft.com/People.Read	No dedicated endpoint call confirmed within this connector's own code	Requested to resolve chat participants to names
https://graph.microsoft.com/Chat.ReadWrite	POST /v1.0/chats GET /v1.0/chats/{id} GET /v1.0/me/chats POST /v1.0/chats/{id}/members POST /v1.0/chats/{id}/messages GET /v1.0/chats/{id}/messages	Read and send Teams chat messages on the user's behalf, and start new chats

What it's useful for: reading and sending Teams chat messages hands-free, and starting new chats.

"What did Dave send me on Teams?"
"Start a chat with the Field Ops group."
"Send Dave a message saying I'm running 10 minutes late."

Note: this connector's behavior can differ between the on-device experience and the Ari Chat experience — some Teams functionality is fuller on Ari Chat than it is on-device today.

Admin Consent

None of the Ari Cloud connectors' permissions require organization-wide admin approval by default — every scope listed above is a standard user-consentable Microsoft Graph permission, so an individual user can connect each one themselves without IT involvement.

That said, some organizations configure their Azure AD tenant to block all user consent, regardless of which permissions are requested. If a user hits this, Ari Cloud automatically generates a tenant-specific admin-consent link for their IT admin to approve — the same mechanism as Collaborate's consent flow..

Notes for IT Admins

Reconnecting after scope changes: the permissions a connector requests are fixed at the moment a user connects it. If RealWear adds a new permission to a connector later, existing connections won't pick it up automatically — the user needs to disconnect and reconnect that connector once to get the updated access.
Per-connector, not all-or-nothing: a user (or their admin, if user consent is blocked) can approve each connector independently. Declining or revoking one (e.g. Email) has no effect on the others (e.g. Calendar).