A tenant audit your client can actually read.

Nothing. The audit uses only the read-only scripts, and the app registration you create for me holds only the Microsoft Graph permissions those scripts read from. It cannot create, change or delete anything, it cannot delete groups and it cannot assign directory roles — not because I promise not to, but because the permissions to do it were never granted. The one script in the library that can write to a tenant is the offboarding script, and it is not part of the audit.

You create that app registration yourself, in your own tenant, by running one setup script as a Global Administrator. I never receive an admin account. When we are finished you delete the app registration and my access ends with it.

Only what the audit actually uses. A setup script creates the app registration, uploads a certificate and grants consent in one command. It deliberately does not request permission to delete groups or assign directory roles, because nothing in the audit needs it. Each script documents its own required permissions in its help block.

For full results, yes — sign-in activity and Conditional Access are premium features. Without them the scripts do not fail: they report everything still available, mark the rest as unknown, exclude unknowns from the totals, and say so plainly in the report. A tenant running Security Defaults is reported as having a valid baseline, not as unprotected.

The scripts talk to Microsoft Graph and write their output as files. There is no telemetry, no analytics and nothing that phones home — the reports are self-contained HTML with no CDN, no remote fonts and no tracking pixel, which is also why they are safe for you to forward.

The one exception is opt-in and off by default: if you want the plain-language executive summary on the front page, aggregate figures — counts and totals only — are sent to the Claude API. Names, email addresses and object IDs are actively blocked from that call. If you would rather it were not used at all, say so and it will not be.

⚑ SIMON — one sentence is missing here and I will not invent it: where the report files and your credential live on Simon's side while the audit runs, and how long they are kept afterwards.

Running one setup script, and half an hour on the phone at the end while I walk you through what I found. The script has to be run by a Global Administrator, because granting consent requires one — that is the only elevated thing about the whole engagement, it happens once, and it happens on your machine rather than mine.

Yes, and I would rather tell you now than have you find it in the report.

Signing in to run the setup script consents three write permissions to Microsoft's own Microsoft Graph Command Line Tools application, and those grants stay behind after setup finishes. Nothing in the script can avoid it — it is how the Graph PowerShell SDK authenticates. My own App Permission Auditor and health score will then flag that application as critical.

That is a true finding, not a false positive: whoever can sign in as that administrator can use those permissions again at any time. It is also easy to clear once setup is done — Entra admin centre → Enterprise applications → Microsoft Graph Command Line Tools → Permissions → Review permissions → revoke. Doing that will prompt the next admin who runs Connect-MgGraph in the tenant to consent again, which is the correct trade.

The report names it where it appears, so nobody has to work out where it came from.

The audit is what I sell today, and everything it produces is built and has been run against real tenants. What I am building toward is a service you would log into rather than a set of reports I hand over — that does not exist yet, there is nothing to sign up for, and the early audits are what shape it. Ask me where it stands before you assume a date.

Yes, and you should. It is plain PowerShell delivered through a private Git repository — nothing compiled, nothing obfuscated. Every function carries full comment-based help. You are pointing this at your clients' tenants; verify it rather than trust it.

Yes — Microsoft 365 and Entra ID projects, tenant migrations, security baselines, and AI automation work. Use the second form below and tell me what you are trying to do.