How to export your tenant snapshot

The scan runs on one JSON file: a snapshot of your Microsoft 365 tenant's settings, shaped like the responses of Microsoft's own Microsoft Graph API. It contains settings and account facts — never email contents, never passwords. This page is the honest, current export path. It is a manual assembly step today; the live connection replaces it.

Where each part comes from

Snapshot section	What it holds	Where it comes from
`users`	Accounts, enabled state, MFA registration, directory roles, guest status, last sign-in	Microsoft Entra ID — Graph `/users`, the authentication methods registration report, and directory role assignments
`inboxRules`	Per-mailbox inbox rules, including any forwarding or redirect targets (rule settings, not message contents)	Exchange — Graph inbox message rules per mailbox, or the Exchange admin rule reports
`tenantSettings`	Legacy authentication state, external sharing level, password policy	Conditional Access / authentication policies, SharePoint admin sharing settings, domain password policy
`oauthGrants`	Third-party app consents: app name, scopes granted, who consented, publisher verification, last use	Enterprise applications — Graph OAuth2 permission grants and service principals
`securityControls`	Conditional Access policy count, EDR and encryption coverage, backup state, training currency, incident response plan	Secure Score / Defender reports for the measurable parts. A few items — backup restore tests, training, a written incident plan — are facts only you can state; the snapshot records what you state, and anything unstated is reported as evidence missing, never assumed

The current process

1. Your admin, or whoever helps you with IT, assembles the export as one JSON file using the sources above. The demo tenant on this site is a complete example of the exact shape — run the demo scan and download its reports to see the format end to end.

2. You upload the file on the scan page. Nothing is installed and there is no Microsoft sign-in.

3. You review the three reports. Fixes are listed as steps in an owner-approved plan; this tool applies nothing.

The shape, trimmed down, looks like this:

{"users": [{"userPrincipalName": "alex@yourbusiness.ca",
              "accountEnabled": true, "mfaRegistered": true,
              "roles": [], "accountType": "member"}],
 "tenantSettings": {"legacyAuthenticationEnabled": false,
              "externalSharingCapability": "ExistingExternalUserSharingOnly"},
 "inboxRules": [], "oauthGrants": [], "securityControls": {...}}

What we will never ask for: your Microsoft username or password. There is no Microsoft sign-in anywhere in this app, by design. Anyone asking for your Microsoft password "for a scan" is not us.

TenantCheck 365 prepares evidence. It does not certify compliance and is not legal or insurance advice.