The live connection — how it will work
Uploading an export works, but it is a snapshot of one day. The monitoring offer — re-scans that catch a new risky app grant or an MFA change between insurance renewals — needs a standing, read-only connection. This is exactly what that connection will require, so you can judge it before it exists:
Step 1 — we register the app
TenantCheck 365 is registered as an application in Microsoft Entra ID (an Azure app registration) with a fixed, published list of read-only permissions: directory and role reads, policy reads, app-consent reads, and rule settings. No mail contents, no write permissions.
Step 2 — your admin consents, not us
A Global Administrator from your own firm opens a Microsoft consent screen, sees the exact permission list, and grants or refuses tenant admin consent. Consent cannot be granted by us, by a salesperson, or by a regular user — Microsoft reserves it for your admin, deliberately. Until that moment, we can see nothing.
Step 3 — the same scan, automatically
With consent in place, the app builds the same snapshot the export produces today and runs the identical checks — same engine, same reports. Monitoring re-runs it on schedule and alerts on change.
Step 4 — you can revoke it any time
Consent is withdrawn in Entra ID under Enterprise applications in about a minute, by your admin, without asking us. Revoking ends all access immediately.
TenantCheck 365 prepares evidence. It does not certify compliance and is not legal or insurance advice.