Start Your Free Assessment

This is the actual scanner. It uses 54 read-only permissions across Microsoft Graph, Exchange Online, and SharePoint to collect security configuration data. It also receives Global Reader and Security Reader directory roles. It cannot modify, delete, or write anything in your tenant.

The setup process creates app registrations and assigns directory roles, which may trigger alerts in your tenant's audit log. This is expected and normal. The setup app removes its own access automatically after the assessment app is created.