Mosaic application - Penrose Education

[e-class]

Hi,

 

After some advice. We've got a couple of teachers who require access to mosaic application from a company called Penrose Education: https://mosaic.penrose.education/.

 

However, it requires admin consent to be able to use our M365 credentials. All well and good, and they have sent me the link to doing that (it's not available publicly in the Azure Poratal (Enterprise Apps).

 

When I do this, it presents the following permissions needed:

 

The first of which seems to overly permissive, so I'm not particularly keen on allowing it (have also been discussing it with the IT/Cyber Govs, who are similarly concerned. Does anyone else use this app? Thoughts?

 

Thanks

[mavhc]

I assume "full access to files" is what's bothering you

 

On the other hand any application you install has way more access, they can take every file on your system and encrypt it and upload it without any permissions

 

https://app.mosaic.penrose.education/#/privacy-policy:~:text=External%20Storage%20Integrations is their reason why

[e-class]

Yes it's point 1 that is especially concerning that it allows access to all files that the user has access to. I've been emailing their support team and as you say, it's their integrations that need it. But the permissions suggest any file that th user has access to in OneDrive, SharePoint etc in the tenant is also open to them.