Tapestry PRMFor IT admins
Someone in your organization may ask you to approve Tapestry PRM, a personal relationship app, for their work or school Microsoft 365 account. Here’s what it reads, where it keeps it, and how to approve or remove its access.
The app
- App: Tapestry PRM, a desktop app for Mac.
- Application (client) ID:
0c73e84a-1596-49c3-aa23-91dabe20ae75 - Publisher: Tapestry PRM (tapestryprm.com), operated by AMS Global Ventures, LLC. Microsoft’s consent screen and your list of enterprise apps show whether Microsoft has verified the publisher.
- It is a public client: it runs on the person’s Mac, signs in there, and has no client secret.
Permissions
Tapestry PRM asks for five delegated Microsoft Graph permissions, for the signed-in person’s own account only. It asks for no application permissions and no permission to write.
| Permission | What it reads |
|---|---|
Sign in and read my profile (User.Read) | The person’s name and email address and the organization’s name, to name the connection. |
Keep access (offline_access) | Nothing by itself. It lets the app read new items without asking the person to sign in each time. |
Read my mail (Mail.Read) | The person’s own mailbox, read-only: the headers and body text of messages from the last 90 days, in every folder except Deleted Items, Junk Email, Drafts and Outbox, then new mail as it arrives. It checks Deleted Items and Junk Email for message IDs only, to tell a message moved there from one that was deleted. |
Read my calendars (Calendars.Read) | Events on the person’s main calendar from 90 days back to 90 days ahead, and later updates, with titles, times, attendees, locations and descriptions. |
Read my contacts (Contacts.Read) | The person’s own Outlook contacts, such as names, email addresses, phone numbers, addresses, companies, job titles, birthdays, notes and photos. |
It also uses the standard sign-in scopes openid, profile and email. It is read-only and reads only the signed-in person’s own mailbox, calendar and contacts. It can’t read anyone else’s mailbox, and it can’t send, change or delete anything.
Optional: Teams chats. The app registration also lists the delegated permission Read my chats (Chat.Read), which Microsoft shows as “Read user chat messages”, so that one admin approval can cover it. The sign-in above doesn’t ask for it, and Teams chats aren’t available yet. When they are, Tapestry PRM asks for it only when a person with a work or school account turns on Teams chats. It then reads that person’s own one-to-one, group and meeting chats that they wrote in, read-only, and never team channels. Those messages are stored only on their Mac and never sent to Tapestry’s servers. If they connect an AI assistant to Tapestry PRM, it can read the messages it looks up, and a cloud assistant sends them to its provider. Remove this permission if your organization doesn’t allow it; mail, calendar and contacts keep working.
What it’s for
Tapestry PRM uses what it reads to show the person who they know, when and how often they’re in touch, and how they could reach someone, and to answer their questions about them, in Tapestry PRM and through AI assistants they connect.
Where the data goes
- On the person’s device. The app signs in at login.microsoftonline.com and reads from Microsoft Graph at graph.microsoft.com, directly from the person’s Mac. What it reads is stored on that device. Microsoft’s sign-in for the account is kept in the macOS Keychain there.
- AI assistants. Only if the person turns on Assistant access, an AI assistant they choose can read it, and a cloud assistant sends what it reads to its provider.
- Always-on, if the person turns it on. Always-on is optional and off until they turn it on. With it on, Tapestry’s hosted service, on Amazon Web Services in the United States, also keeps a copy of what their AI assistants can read, which can include this mail, calendar and contacts, and reads that copy to answer their assistants, including while their device is asleep or off. The copy leaves out the text of attachments. It is encrypted so that only a key made for that person’s copy alone can open it. No one at Tapestry can read it alone; code Tapestry runs on the service can, and a legal demand served on AMS Global Ventures, LLC can require it to be produced. Turning Always-on off deletes the copy.
- When you remove access. If you remove Tapestry PRM’s access, the app reads nothing new from the account. The next time it tries to read the account, it takes the account’s data out of the person’s Always-on copy: answers stop showing it within about a minute while their Mac is online, and the stored copy keeps it until a fresh copy replaces it, within 24 hours while their Mac runs. What was already read stays on the person’s device.
Tapestry’s hosted service never signs in to Microsoft, holds a Microsoft token or calls Microsoft Graph, so Always-on asks for no further permission. Our privacy notice describes Always-on in full.
What you can see in your tenant
- An enterprise app named Tapestry PRM, added the first time someone in your tenant consents to it or asks for approval. It shows the publisher, the delegated permissions granted, and whether each grant came from one person or from an admin for your whole organization.
- Admin consent requests, if your organization uses the admin consent workflow: who asked, their reason and the permissions requested.
- Sign-in logs: each interactive sign-in, and each token refresh as a non-interactive sign-in.
- Where your tenant has them turned on, Microsoft Graph activity logs and mailbox auditing, such as
MailItemsAccessed.
Approving Tapestry PRM
You need at least the Cloud Application Administrator role and, to approve a request, to be one of its designated reviewers. Review the permissions above before you approve. Approving grants admin consent for your whole organization, so everyone in your tenant can then connect without asking again, unless you require assignment for the app and assign only the people who may use it.
- If someone sent a request through Microsoft. In the Microsoft Entra admin center, go to Entra ID → Enterprise apps, and under Activity choose Admin consent requests. Open Tapestry PRM, review the permissions and approve.
- Otherwise. Once Tapestry PRM appears under Entra ID → Enterprise apps → All applications, open it, choose Permissions under Security, review the permissions and choose Grant admin consent. If it isn’t listed because your organization doesn’t let people consent to apps themselves, turn on the admin consent workflow so the person’s request reaches you.
The person then chooses Try again in Tapestry PRM.
Removing access
You can remove Tapestry PRM’s access at any time, in the Microsoft Entra admin center under Entra ID → Enterprise apps → All applications → Tapestry PRM:
- revoke the permissions your organization granted, in Permissions on the Admin consent tab;
- stop everyone signing in to it, by setting Enabled for users to sign-in to No in Properties;
- or delete the enterprise app.
Revoking on the Admin consent tab removes what your organization granted. Permissions a person granted for themselves are on the User consent tab, which the portal can’t revoke, and people can consent again; to stop everyone, turn off sign-in for the app or delete it.
Tapestry PRM then tells the person that your organization removed its access. It reads nothing new from the account, and the account’s data leaves their Always-on copy, as above. What was already read stays on their device, under their control.
Resetting a person’s password in the Microsoft Entra admin center also ends the app’s refresh tokens for that person, who must then sign in again. People can also remove the app at myapps.microsoft.com, where your settings allow it.
Contact
Questions from IT teams: hello@tapestryprm.com. Security reports: security@tapestryprm.com, as our vulnerability disclosure policy describes.