You're trusting us with a view into your customers' Microsoft 365 tenants. Here is exactly what we can access, how we protect it, and how to switch it off.
Each assessment area is a separate module app with read-only permissions: it can't create, change or delete users, policies, devices or data. Two opt-in modules need broader access because Microsoft offers nothing narrower; they're off unless you switch them on, clearly labelled, and only ever used to read.
Our engine signs in to each module app with workload identity federation: its Azure managed identity is the credential. There's no client secret or certificate to leak or rotate, tokens are short-lived, and they're never logged or written to disk.
Each assessed tenant's results live in their own storage container. Access to report files uses short-lived links scoped to that one container.
Our database enforces row-level security by organization. Even if application code asked for the wrong rows, the database would return only the signed-in organization's data.
All traffic to our site, app and APIs is encrypted in transit with TLS, with HSTS and a strict content security policy. Data is encrypted at rest by Azure Storage and Azure SQL.
You sign in to M365Assessments with your Microsoft work account. We never see or store your password, and your organization's MFA and Conditional Access policies apply.
Each module is its own Microsoft Entra application, and the tenant's Global Administrator approves each one separately. Microsoft grants a module exactly the permissions below. Read-only modules use application permissions that only read; the Exchange & Security and Teams modules also get Microsoft's built-in, view-only Global Reader role, assigned during onboarding.
No *.ReadWrite.* permission and no write role. The only write-capable access, SharePoint Sites.FullControl.All and a Power Platform management-app registration, belongs to the two opt-in modules, which you enable explicitly.
We don't request permissions to read email, files, Teams chats, calendars or documents. We read configuration and metadata.
Every request the engine sends reads data, in every module, including the opt-in ones. The one POST it uses is a Microsoft Graph $batch call that bundles read requests together.
| # | Permission | What we use it for |
|---|---|---|
| Core module (always required): identity & tenant core (Microsoft Entra ID) | ||
| 1 | Directory.Read.All | Users, groups, roles, applications and other directory objects that most checks build on. |
| 2 | Organization.Read.All | Tenant profile, verified domains and subscriptions. |
| 3 | AuditLog.Read.All | Sign-in activity: legacy-authentication usage, stale accounts and last sign-in dates. |
| 4 | SecurityEvents.Read.All | Microsoft Secure Score and its control profiles. |
| 5 | Policy.Read.All | Conditional Access, authentication methods, authorization and cross-tenant access policies. |
| 6 | RoleManagement.Read.Directory | Admin role assignments and Privileged Identity Management (PIM) eligibility. |
| 7 | IdentityRiskyUser.Read.All | Users flagged as risky by Microsoft Entra ID Protection. |
| 8 | IdentityRiskEvent.Read.All | Risk detections, including risky sign-ins. |
| 9 | IdentityRiskyServicePrincipal.Read.All | Risky workload identities (service principals) and their detections. |
| 10 | Agreement.Read.All | Terms of use agreements. |
| 11 | AccessReview.Read.All | Access review definitions. |
| 12 | DirectoryRecommendations.Read.All | Microsoft Entra recommendations for the tenant. |
| 13 | OnPremDirectorySynchronization.Read.All | Microsoft Entra Connect (directory sync) configuration. |
| 14 | CrossTenantInformation.ReadBasic.All | Resolving partner tenant names in cross-tenant access settings. |
| 15 | Synchronization.Read.All | Provisioning (SCIM) jobs on enterprise applications. |
| Devices (Microsoft Intune) | ||
| 16 | DeviceManagementManagedDevices.Read.All | Managed device inventory, compliance state and device clean-up rules. |
| 17 | DeviceManagementConfiguration.Read.All | Compliance and configuration profiles, settings catalog, endpoint security and update rings. |
| 18 | DeviceManagementApps.Read.All | Managed apps and iOS/Android app protection policies. |
| 19 | DeviceManagementServiceConfig.Read.All | Windows Autopilot devices and profiles, enrollment and connector configuration. |
| 20 | DeviceManagementRBAC.Read.All | Intune role settings, including multi-admin approval. |
| 21 | DeviceManagementScripts.Read.All | Platform scripts and remediations. |
| Licensing & usage | ||
| 22 | Reports.Read.All | Microsoft 365 active-user and usage reports, including Microsoft 365 Copilot usage. |
| 23 | ReportSettings.Read.All | Whether the tenant conceals user names in usage reports. |
| # | Permission | What we use it for |
|---|---|---|
| Exchange & Security module: Exchange Online, Defender for Office 365, Defender for Identity, Purview (read-only) | ||
| 1 | Exchange.ManageAsApp | Signing in to Exchange Online and Security & Compliance PowerShell as an app. It grants no rights on its own: the Global Reader role below limits it to view-only cmdlets. |
| 2 | SecurityEvents.Read.All | Secure Score and its control profiles. |
| 3 | SecurityIdentitiesSensors.Read.All | Defender for Identity sensor deployment and health. |
| 4 | Organization.Read.All | Subscriptions, to know which Defender features are licensed. |
| 5 | Domain.Read.All | Your domains, to check DKIM, SPF and DMARC. |
| 6 | RoleManagement.Read.Directory | Admin role members, so admin mailboxes are checked first for risky inbox rules. |
| 7 | Global Reader (directory role) | Microsoft's built-in view-only role. It lets Exchange, Purview and Teams PowerShell read settings and can't change anything. |
| SharePoint & OneDrive module (read-only) | ||
| 1 | SharePointTenantSettings.Read.All | Tenant sharing settings. |
| 2 | Sites.Read.All | Site inventory and templates. We don't open documents. |
| 3 | Reports.Read.All | Site and OneDrive storage and activity reports. |
| 4 | ReportSettings.Read.All | Whether usage reports conceal user names. |
| 5 | GroupMember.Read.All | Owners of group-connected sites. |
| Microsoft Teams module (read-only) | ||
| 1 | Organization.Read.All | Tenant lookup when Teams PowerShell signs in as the app. |
| 2 | TeamSettings.Read.All | Team settings for the team inventory. |
| 3 | TeamworkDevice.Read.All | Teams Rooms and phones, and their health. |
| 4 | GroupMember.Read.All | Member, owner and guest counts per team. |
| 5 | Channel.ReadBasic.All | Channel counts per team (names only, never messages). |
| 6 | Global Reader (directory role) | View-only role for Teams policy and voice settings. |
| Power Platform module: opt-in, NOT read-only | ||
| 1 | Organization.Read.All | Tenant identity check before Power Platform collection. |
| 2 | Power Platform management application (registration) | Your admin registers the module app during onboarding. Microsoft gives management applications the same API access as a Power Platform administrator and offers no read-only option. We only read environments, DLP policies, apps, flows and connectors. |
| SharePoint Advanced module: opt-in, NOT read-only | ||
| 1 | Sites.FullControl.All (SharePoint) | The only permission Microsoft accepts for the SharePoint tenant admin settings we use for the full sharing and access audit. It would allow changes to any site; we only read tenant settings with it. |
Opt-in modules are off by default. Your service provider has to select one and confirm that it isn't read-only, and the consent screen shows exactly what's requested. Assigning Global Reader happens in your administrator's own browser during onboarding: our M365 Assessment – Onboarding app has only delegated permissions (RoleManagement.ReadWrite.Directory, Application.Read.All, and PowerApps User for Power Platform), which act only as the signed-in admin while they're signed in. The admin's token is never sent to us, and the app keeps no access afterwards. Sign-in to the M365Assessments portal itself asks only for your basic profile (openid, profile, email, User.Read). Tenants connected before modules were introduced use our original read-only Collector app until their admin re-onboards.
Reports name users, admins, devices and apps where that's relevant to a finding (for example, "these 12 users aren't registered for MFA").
Data residency: M365Assessments runs on Microsoft Azure, and assessment data is stored in Azure data centers in the United States. Regional hosting outside the US isn't offered yet. Tell us if you need it.
Managed Azure services, protected at the edge, with managed identities between components.
Global entry point with a web application firewall in front of the app and API.
The portal API and assessment engine run as containers. Each assessment runs as its own job.
Workspace, tenant and run metadata, with row-level security by organization.
Holds our signing key (and, for tenants still on the original Collector app, its certificate). Module apps need no key material at all. Access is by managed identity and role-based access control.
One container per assessed tenant for collected data and reports.
Sign-in for every user. Tokens are validated on every API request.
Consent is granted by the tenant's own administrator, and it can be withdrawn by that administrator at any time, with no ticket and no waiting on us.
Once the enterprise app is deleted, our app can no longer get tokens for that tenant, so no further assessments can run. Want stored reports for that tenant deleted too? Email hello@m365assessments.com from an admin address in that tenant and we'll delete them.
Sign in at entra.microsoft.com as a Global Administrator, Cloud Application Administrator or Application Administrator.
Browse to Enterprise applications (under Applications) and search for M365 Assessment. Each module you approved is listed separately; older connections show M365Assessments Collector.
Open each one, select Properties, then Delete. This removes the service principal, its permissions and its role assignments. For Power Platform, also remove it from the management applications (Remove-PowerAppManagementApp).
We don't hold SOC 2 or ISO 27001 certification today. M365Assessments is in early access. We're working toward independent third-party assessment and will publish our status here as it progresses.
In the meantime, we're happy to answer your security questionnaire and walk your team through our architecture. Contact us.
We welcome reports from security researchers and will work with you to understand and fix any issue quickly.
Our security contact is also published at /.well-known/security.txt.
We'll walk through our architecture, permissions and data handling with you, or fill in your questionnaire.