Calamari needs to be installed by the Azure AD admin. During the installation process, the admin will be prompted with the consent screen:
Calamari needs read only access to user directory in order to provide you with the possibility to import employees from Azure AD
Calamari needs sign in and read user profile in order to provide you with SSO feature.