Approve read-only access
A Global Administrator signs in to Microsoft and approves read-only access for . You never share a password with us, and you can remove access at any time. Checking Exchange Online needs one more step afterwards, which we'll walk you through.
Sign in with Google
A Google Workspace super admin signs in so we can confirm your organization. Google only shares the account's name and email address with ; you never share a password with us.
Authorize read-only access
Signed in as . Now give read-only access in your Google Admin console. It takes about two minutes and only needs to be done once.
- Open Security → Access and data control → API controls → Manage Domain Wide Delegation
- Select Add new
- For Client ID, paste:
- For OAuth scopes, paste this whole line:
- Select Authorize, then come back and select Check again. Google usually applies it within a few minutes, occasionally longer.
Every scope ends in .readonly: they let read settings, users and audit logs, not change them, and never email or file contents. Deleting the entry later removes all access.
Request received
Keep this page bookmarked, or come back to this same link. It updates when your request is approved.
Run the assessment toolkit
One file per device: Cisco show running-config output, FortiGate .conf backups, Palo Alto running-config.xml, Aruba configs. Passwords, keys, hashes and SNMP communities are removed in this browser before anything is sent.
| Device | Files | Secrets removed |
|---|
Collects live from your devices with a read-only login, or reads a folder of backups on a computer you choose.
- It takes a few minutes. When it finishes it shows your grade, and this page updates.
Waiting for results… keep this page open, or come back to this same link later.
Lost the download?
Connecting to your tenant…
This usually takes less than a minute.
- Access approved
- Connected to Microsoft 365
- Checking licenses and activity
- Preparing your report
Keep this page open. Your report appears here when it finishes.
One setting to change first
Your tenant hides user names in Microsoft's usage reports, so we can't tell which licenses are actually being used.
- Open Microsoft 365 admin center → Settings → Org settings → Reports
- Clear Display concealed user, group, and site names in all reports
- Select Save, wait a few minutes, then check again here
One more step: read-only Exchange access
Access is approved. To check your Exchange Online settings (mail forwarding, anti-phishing, transport rules, auditing and more), Microsoft also needs the app to hold the read-only Global Reader role.
- Open Microsoft Entra admin center → Roles & admins
- Select Global Reader, then Add assignments
- Search for (app ID ), select it and assign it
- Come back and select Check again. Exchange can take a few minutes, occasionally longer, to recognize the new role.
Global Reader can view settings across Microsoft 365 but can't change anything. Deleting the app in Microsoft Entra later also removes the role.
One more step: read access to your Azure subscriptions
The approval is done. Azure keeps its own permissions, so the app also needs two read-only roles on the subscriptions you want checked.
- Open Azure portal → Subscriptions and pick a subscription (or, for all of them at once, Management groups → Tenant Root Group)
- Select Access control (IAM) → Add → Add role assignment
- Choose Reader, then on Members select Select members, search for (app ID ) and select Review + assign
- Repeat with Cost Management Reader
- Come back and select Check again. New roles can take a few minutes to apply.
Both roles only read: they can't create, change or delete anything, or see data inside your resources. Removing the role assignments, or deleting the app in Microsoft Entra, removes access.
Connected. Ready to run.
The assessment takes 2–5 minutes for most tenants and only reads data.
Your report is ready
Save a copy now. This download link works for 7 days.
Exchange Online settings weren't included because the Global Reader step wasn't completed. Complete it and start again for the full report.
To remove our read-only access later, a Global Administrator can delete the app in Microsoft Entra.
To remove our read-only access later, a super admin can delete our entry in the Google Admin console → Domain-wide delegation.