How M365Assessments protects tenant data

Least-privilege, read-only access

• One app per module, each with only the read-only permissions its checks need. The engine only sends read requests, in every module.
• Two opt-in modules need write-capable access because Microsoft offers nothing narrower. They are off by default, labelled “Not read-only · opt-in” everywhere, need a recorded acknowledgement, and can be removed by the customer at any time.
• No standing write access: the only step that changes anything in a customer tenant (assigning Global Reader, registering Power Platform) runs in the customer administrator’s own browser with their own sign-in, and that token is never sent to us.

No secrets or certificates

Our assessment engine signs in to the module apps with workload identity federation: its Azure managed identity is the only credential they trust. There is no client secret or certificate to leak or rotate, tokens are short-lived, and they are never logged or written to disk. Our own services reach the database, storage and Key Vault with managed identities, not passwords.

Isolation between organizations

• Every request is checked against your organization membership and role before any data is read.
• The database enforces row-level security per organization, so even a faulty query can only return the signed-in organization’s rows.
• Each customer’s results live in their own storage container. Report downloads use read-only links scoped to that one container that expire after 10 minutes.

Signed, expiring links

• Onboarding links are signed, bound to one customer tenant and its module list, expire after 72 hours, and are rechecked on every step. Disabling a module or offboarding the customer invalidates them. A leaked link grants nothing: consent is still given at Microsoft by that tenant’s administrator.
• Consent from any tenant other than the expected one is refused.
• Invitation links are single-use and expire after 7 days; only a hash of the link is stored.

Platform security

• All traffic uses TLS with HSTS and a strict content security policy; data is encrypted at rest.
• The app sits behind Azure Front Door with a web application firewall.
• Changes in your organization are recorded in an audit log.