Before you sign in
What happens when you connect your tenant
A quick overview of how your browser reads your tenant, and every Microsoft Graph permission it will ask for. All read-only.
How the architecture works
The short version: we have no backend that sees your data.
Runs entirely in your browser
All Microsoft Graph calls are made from your browser directly to Microsoft. No backend, no proxy.
No servers, no storage
We do not host any backend that receives your tenant data. Nothing is logged, cached, or persisted on our side.
PDF generated client-side
The report is rendered in your browser with jsPDF and streamed straight to your downloads folder.
Standard OAuth 2.0 + MSAL
We use the official Microsoft Authentication Library (MSAL). Tokens live in your browser's session storage and are scoped to read-only operations.
The 22 permissions we request
All read-only. An admin must consent once per tenant.
Identity & Directory
4 scopesUser.ReadBasic profile of the signed-in userDirectory.Read.AllUsers, tenant properties, org structureGroup.Read.AllSecurity and Microsoft 365 groupsDomain.Read.AllVerified custom domains
Security & Access Control
5 scopesPolicy.Read.AllConditional Access and security policiesIdentityRiskyUser.Read.AllIdentity Protection monitoringIdentityRiskEvent.Read.AllRisk detection eventsAuditLog.Read.AllPIM activation historyRoleManagement.Read.DirectoryDirectory role assignments
Privileged Identity Management
6 scopesRoleEligibilitySchedule.Read.DirectoryPIM role eligibilityRoleAssignmentSchedule.Read.DirectoryActive PIM role assignmentsRoleManagementPolicy.Read.DirectoryPIM policiesPrivilegedEligibilitySchedule.Read.AzureADGroupPIM for Groups eligibilityPrivilegedAssignmentSchedule.Read.AzureADGroupPIM for Groups assignmentsPrivilegedAccess.Read.AzureResourcesPIM for Azure resources
Identity Governance
4 scopesEntitlementManagement.Read.AllAccess packages and catalogsAccessReview.Read.AllAccess certification trackingAgreement.Read.AllTerms of use agreementsAgreementAcceptance.Read.AllTerms of use acceptance records
Applications
2 scopesApplication.Read.AllApp registrations and service principalsPolicy.Read.PermissionGrantOAuth2 grants and consent policies
External Identities
1 scopeIdentityProvider.Read.AllSAML/WS-Fed identity providers
Your data never leaves your Microsoft tenant. Reports are generated entirely in your browser - nothing is uploaded to or stored on our servers. Microsoft's official permissions reference.