Calamari needs to be installed by the Azure AD admin. During the installation process, the admin will be prompted with the consent screen:
Calamari needs read only access to user directory in order to provide you with the possibility to import employees from Azure AD
Calamari needs sign in and read user profile in order to provide you with SSO feature.
Above mentioned points are the only common points required by Calamari integration with Office 365/Azure AD. Data accessed to provide successful integration are name, surname, e-mail address, and additionally avatar from Office/Azure domain. Thanks to this you can import users and they can log in via SSO.