← AI inventory

Otter.ai

Entra consent Otter.ai (AISense) · Meeting notes · publisher 'aisense inc'

Policy · none set
Policy changes re-score this app on the next sync, which starts right away.
Finding · Open
Risk score
85
Critical
People
3
Granted with a work identity
Permission tier
High
8 permissions
First seen
May 2, 2026
Last seen 42 h ago
unverified-publisheractive-7d
Next steps

Recommended actions

  1. 01Otter.ai holds application permissions and can read data with no user signed in. Review the app role assignments and remove any that are not essential.
  2. 02Scopes expose calendar, directory, email, meetings. Evaluate the vendor's retention and training terms before allowing continued use.
  3. 03Sign-ins came from 2 countries (US, GB). Check that matches where these people work.
  4. 04Meeting bots capture every participant, including external parties. Confirm consent and recording policy allow it.
Same app, other lanes

Related findings

Access

Permissions

PermissionGrantsConsent types
Calendars.Read3User consent
Mail.Read1Application (app-only)
OnlineMeetingTranscript.Read.All1User consent
OnlineMeetings.Read2User consent
User.Read3User consent
offline_access3User consent
openid3User consent
profile3User consent
Who

People

PersonDepartmentSourceSign-ins · 30 dGranted
Alice Ng
[email protected]
SalesGrant + sign-ins10 · 42 h agoCalendars.Read, OnlineMeetingTranscript.Read.All, OnlineMeetings.Read, User.Read, offline_access, openid, profile
Bob Okafor
[email protected]
FinanceGrant + sign-ins6 · 8 d agoCalendars.Read, OnlineMeetings.Read, User.Read, offline_access, openid, profile
Carol Diaz
[email protected]
HRConsent grant0Calendars.Read, User.Read, offline_access, openid, profile
Consent

Grants

TypePrincipalPermissionsGranted
User consent[email protected]Calendars.Read, OnlineMeetingTranscript.Read.All, OnlineMeetings.Read, User.Read, offline_access, openid, profilen/a
User consent[email protected]Calendars.Read, OnlineMeetings.Read, User.Read, offline_access, openid, profilen/a
User consent[email protected]Calendars.Read, User.Read, offline_access, openid, profilen/a
Application (app-only)Microsoft GraphMail.ReadJun 1, 2026
Usage · 30 days

Who actually uses it

Sign-ins
16
People
2
Last 7 days
1
2026-08-16: 22026-08-17: 02026-08-18: 02026-08-19: 12026-08-20: 02026-08-21: 02026-08-22: 02026-08-23: 22026-08-24: 02026-08-25: 02026-08-26: 02026-08-27: 22026-08-28: 12026-08-29: 12026-08-30: 02026-08-31: 22026-09-01: 12026-09-02: 02026-09-03: 02026-09-04: 02026-09-05: 12026-09-06: 12026-09-07: 02026-09-08: 02026-09-09: 02026-09-10: 12026-09-11: 02026-09-12: 12026-09-13: 02026-09-14: 0
08-1609-14
Last sign-in42 h ago
CountriesUS · 15GB · 1
ClientsBrowser · 10Mobile Apps and Desktop clients · 6
Why

Evidence

  1. service_principal · May 2, 2026
    Service principal 'Otter.ai' present in tenant (publisher: AISense Inc)
    Detail
    {
  "appId": "aaaa0001-0000-4000-8000-000000000001",
  "homepage": "https://otter.ai",
  "objectId": "sp-otter",
  "publisherName": "AISense Inc",
  "accountEnabled": true,
  "verifiedPublisher": null
}
  2. delegated_grant
    [email protected] granted Calendars.Read, OnlineMeetingTranscript.Read.All, OnlineMeetings.Read, User.Read, offline_access, openid, profile
    Detail
    {
  "grantId": "g-otter-1",
  "resourceId": "sp-graph",
  "consentType": "Principal",
  "principalId": "u1"
}
  3. delegated_grant
    [email protected] granted Calendars.Read, OnlineMeetings.Read, User.Read, offline_access, openid, profile
    Detail
    {
  "grantId": "g-otter-2",
  "resourceId": "sp-graph",
  "consentType": "Principal",
  "principalId": "u2"
}
  4. delegated_grant
    [email protected] granted Calendars.Read, User.Read, offline_access, openid, profile
    Detail
    {
  "grantId": "g-otter-3",
  "resourceId": "sp-graph",
  "consentType": "Principal",
  "principalId": "u3"
}
  5. application_grant · Jun 1, 2026
    Application permission Mail.Read on Microsoft Graph
    Detail
    {
  "appRoleId": "810c84a8-4a9e-49e6-bf7d-12d183f40d01",
  "resourceId": "sp-graph",
  "assignmentId": "ara-otter-1"
}
  6. sign_in_activity · Sep 12, 2026
    16 successful sign-ins by 2 people in the last 30 days
    Detail
    {
  "clients": [
    {
      "count": 10,
      "client": "Browser"
    },
    {
      "count": 6,
      "client": "Mobile Apps and Desktop clients"
    }
  ],
  "countries": [
    {
      "count": 15,
      "country": "US"
    },
    {
      "count": 1,
      "country": "GB"
    }
  ],
  "windowDays": 30,
  "activeUsers7d": 1
}
  7. consent_event · Aug 25, 2026
    Add app role assignment to service principal. by [email protected]
    Detail
    {
  "scopes": [],
  "recordId": "ual-0097",
  "isAdminConsent": false
}
Summary

Consent types

  • User consent
  • Application (app-only)