How we keep your tenant safe
Tenant Strike can see your Microsoft 365 and Azure settings. It cannot change them. And you don’t have to take our word for it — the proof, down to every single API call we make, is published on this page.
01
When your admin grants access, the 12 Microsoft permissions we request are all read-only — they let us see configuration, not change it. We don't request any "write" permission, because we don't have any code that could use one.
02
Our scanner lists users, reads policies, and checks settings. It cannot create, modify, or delete anything in your Microsoft 365. Every API call we make is logged so you can see exactly what we did.
03
Our build process automatically lists every API call in our code and fails the build if any "write" call sneaks in. Your security team can verify it themselves in five minutes — evidence below.
What we look at
Tenant Strike checks the parts of your Microsoft 365 tenant that attackers target. Here's what each surface covers.
Sign-in policies, MFA enforcement, admin accounts, guest access. We see how people log in, not what they do once signed in.
DMARC, SPF, DKIM, Defender for Office policies, forwarding rules. We never read message content.
SharePoint, OneDrive, and Teams external-sharing settings. We see the settings, not the documents being shared.
Enterprise apps and the permissions they were granted. Useful for spotting OAuth phishing and over-privileged add-ins.
Intune compliance, BitLocker, Defender for Endpoint coverage. We see device status, not what's on the device.
Whether your audit log is on, where security alerts go, and what gets recorded. The forensics-readiness surface.
What your tenant looks like from the public internet — exposed ports, expired TLS, DNS health. Outside-in, not inside your tenant. We also make read-only HTTPS requests to the portals and domains you list, to read their product/version banners — only to hosts under a domain Microsoft has verified you own, and only when you opt in.
Configuration metadata only.
Never file, mailbox, or chat content.
Permissions we request
These are the 12 Microsoft Graph permissions your admin grants at consent time. Every one ends in .Read or .Read.All. There is no .ReadWrite in the list.
Directory.Read.AllreadRead users, groups, and role assignments to evaluate admin sprawl, MFA coverage, and guest access.
Policy.Read.AllreadRead Conditional Access policies, authorization policies, and Security Defaults state.
Reports.Read.AllreadRead sign-in reports and inactive-account reports for stale admin / guest detection.
AuditLog.Read.AllreadVerify that the Unified Audit Log is enabled and check audit ingestion health.
Application.Read.AllreadInspect enterprise apps for risky Graph permissions, expiring secrets, and consent posture.
SecurityEvents.Read.AllreadRead Defender for Endpoint alerts and Microsoft Secure Score data.
SharePointTenantSettings.Read.AllreadRead SharePoint tenant-wide settings — sharing scope, link expiration, sync restrictions, legacy auth.
MailboxSettings.ReadreadDetect inbox-rule forwarding abuse and auto-forwarding misconfigurations — a top BEC indicator.
DeviceManagementManagedDevices.Read.AllreadRead Intune-enrolled devices and their detected-app inventory for compliance posture, BitLocker coverage, and vulnerability matching.
DeviceManagementConfiguration.Read.AllreadRead Intune compliance and configuration policies to confirm enforcement.
DeviceManagementApps.Read.AllreadRead Intune app-protection and app-configuration policies for mobile device coverage.
OrganizationalBranding.Read.AllreadRead your organization's sign-in branding so the dashboard can show your logo. Branding only — nothing else.
Reproduce it yourself
Tenant Strike's GraphReadOnlyClient (src/auth/graph.ts) exposes only GET. This manifest is regenerated on every build by scripts/build-graph-endpoints.ts, which fails the build if any write verb (post/patch/put/delete) is detected on a receiver typed as GraphReadOnlyClient. The list below is the complete set of Microsoft Graph endpoints Tenant Strike calls, with source-file references for line-level verification.
TypeScript AST walker (src/auth/graph-endpoint-extractor.ts) — resolves the receiver's type to GraphReadOnlyClient regardless of variable name. Catches aliases and `as any` casts that the prior regex-based extractor could have missed.Endpoint manifest · auto-extracted
<dynamic>L21<dynamic>L26<dynamic>L31/domainsL68/domainsL177/organizationL52/organization/${orgId}/branding/localizations/default/squareLogoL61/organization/${orgId}/branding/localizations/default/bannerLogoL62/organization/${orgId}/branding/localizations/default/squareLogoDarkL64/subscribedSkusL65/policies/adminConsentRequestPolicyL28/applicationsL37/servicePrincipals(appId='00000003-0000-0000-c000-000000000000')L59/servicePrincipalsL83/servicePrincipals/${sp.id}/appRoleAssignmentsL95/policies/authorizationPolicyL57/deviceManagement/managedDevices/${d.id}/windowsProtectionStateL93/security/alerts_v2L55/deviceManagement/managedDevicesL79/deviceManagement/deviceCompliancePoliciesL89/deviceAppManagement/iosManagedAppProtectionsL106/deviceAppManagement/androidManagedAppProtectionsL115/usersL69/users/${u.id}/mailFolders/inbox/messageRulesL99/policies/authenticationMethodsPolicyL43/policies/conditionalAccessPoliciesL61/policies/authorizationPolicyL35/directoryRolesL63/directoryRoles/${role.id}/membersL73/users/${m.id}L89/policies/identitySecurityDefaultsEnforcementPolicyL20/usersL29/directoryRolesL35/directoryRoles/${gaRole.id}/membersL63/reports/authenticationMethods/userRegistrationDetailsL27/organizationL50/auditLogs/directoryAuditsL36/auditLogs/signInsL71/policies/crossTenantAccessPolicy/defaultL52/policies/crossTenantAccessPolicy/partnersL61/admin/sharepoint/settingsL71/domainsL61/domainsL207/security/secureScoresL31/security/secureScoreControlProfilesL67/deviceManagement/detectedAppsL46/deviceManagement/managedDevicesL49Azure Resource Manager · machine-verified read-only
The same automated build check covers our Azure code: every call we make to Azure is a read. We never change, create, or delete anything in your subscriptions.
/subscriptions/${subId}/providers/Microsoft.Security/pricings/providers/Microsoft.ResourceGraph/resources/subscriptions/${subId}/providers/Microsoft.Authorization/roleAssignments/subscriptions/${subId}/providers/Microsoft.Insights/diagnosticSettings/subscriptions/${subId}/providers/Microsoft.Security/autoProvisioningSettings/subscriptionsThe one POST in the list is Azure's Resource Graph query endpoint — Azure requires POST there only because the (read-only) query is too long to fit in a URL. Nothing is changed by it, and our build check treats it as the single documented exception.
Comfortable with how we work?
No write scopes, no agents, and a setup that takes a few minutes. See what your tenant looks like to an attacker.