What you are granting, and why
When you connect a Microsoft 365 or Google Workspace tenant to one of the diagnostic tools, this page lists every permission requested, why it is requested, what is stored, what is never stored, and how to remove access. It is generated from the code that makes the request, so it cannot drift from what we actually ask for.
The short version
- Read-only. Every Microsoft Graph permission requested is a Microsoft read permission (the name ends in
.Read.Allor.Read.Directory). No permission to create, change, or delete anything in your tenant is requested. - You are the controller. For the directory data these tools read, you are the data controller and ITSailor acts as your data processor. The processing runs on your instruction, which you give by connecting your tenant.
- Identities are digested before logging. Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs. The report shown to your administrator still carries real identities, because it is your own tenant and you need them to act.
- You can revoke at any time. Your administrator removes the grant directly with Microsoft or Google, without us, and all further reads stop at once.
SaaS Auditor
Microsoft GraphReads directory, licence, and security posture to find dormant accounts, wasted licences, Shadow IT, and standing admin risk.
A Microsoft 365 tenant administrator approves the connection. Every permission below is read-only.
| Permission | Why it is requested | Access | What is stored | Never stored |
|---|---|---|---|---|
User.Read.All | Read the user roster and account status, so the audit can count active, disabled, and stale accounts. | Read-only | Counts and posture flags for the report shown to your administrator. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
AuditLog.Read.All | Read sign-in activity (last sign-in dates), so dormant and unused accounts can be found. | Read-only | Counts and posture flags for the report shown to your administrator. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
Organization.Read.All | Read tenant and licence inventory, so assigned licences can be matched to active use. | Read-only | Licence counts and utilisation figures for the report. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
Directory.Read.All | Read service principals and OAuth grants for Shadow IT and third-party app discovery. | Read-only | Counts and posture flags for the report shown to your administrator. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
Application.Read.All | Read the registered and enterprise application detail behind those grants. | Read-only | Counts and posture flags for the report shown to your administrator. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
SecurityEvents.Read.All | Read Microsoft Secure Score and security findings for posture context. | Read-only | Secure Score figures and finding counts for the report. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
Policy.Read.All | Read Conditional Access policy posture. | Read-only | Policy posture flags for the report. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
RoleManagement.Read.Directory | Read the directory role roster to find standing, non-PIM administrator assignments. | Read-only | The count of standing privileged assignments for the report. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
IdentityRiskEvent.Read.All | Read Entra identity-risk detections (risky sign-ins), where the tenant licence exposes them. | Read-only | Risk-detection counts for the report. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
Reports.Read.All | Read per-service usage reports to measure feature-level adoption. | Read-only | Aggregate adoption figures for the report. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
offline_access | Let the connector refresh its own access token, so you can enrol in continuous monitoring without signing in again. | Read-only | Your sign-in refresh token, held server-side and encrypted, for up to 30 minutes so you can enrol in continuous monitoring (Tenant Monitor) without signing in again. On enrol it moves to encrypted long-term storage; otherwise it expires and is deleted. | The token is never written in plaintext and never reaches your browser. This permission carries no directory read access. |
How long it is kept
Your report is held server-side for up to ten minutes so the page can load it, then it expires. When you start a scan, your sign-in refresh token is also held server-side, encrypted, for up to thirty minutes so you can enrol in continuous monitoring without signing in again, then it is deleted. If you enrol in continuous monitoring (Tenant Monitor), the encrypted refresh token and the aggregate posture move to long-term storage so the scan can repeat on schedule; if you never enrol, nothing is kept.
How to revoke
A tenant administrator can remove the grant at any time in the Microsoft Entra admin center, under Enterprise applications, by deleting the ITSailor application. Revoking access stops all further reads at once.
SaaS Auditor
Google Workspace Admin SDKReads the Workspace directory and per-user security state for the same dormant-account, licence, and Shadow IT audit.
A Google Workspace super administrator approves the connection. Every permission below is read-only.
| Permission | Why it is requested | Access | What is stored | Never stored |
|---|---|---|---|---|
https://www.googleapis.com/auth/admin.directory.user.readonly | Read the user list and per-user status, last login, and administrator flag. | Read-only | Counts and posture flags for the report shown to your administrator. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
https://www.googleapis.com/auth/admin.directory.domain.readonly | Read domain and customer account information. | Read-only | Domain and account figures for the report. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
https://www.googleapis.com/auth/admin.directory.user.security | Read per-user third-party OAuth token grants (for Shadow IT discovery) and two-step verification state. | Read-only | Shadow IT grant counts and MFA-coverage figures for the report. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
How long it is kept
Your report is held server-side for up to ten minutes so the page can load it, then it expires. No sign-in token is stored: the one-off Google scan keeps nothing beyond that window. Use of Google Workspace data follows the Google API Services User Data Policy, including the Limited Use requirements.
How to revoke
A Workspace super administrator can remove the grant at admin.google.com under Security, API controls, App access control, or a user can remove it at myaccount.google.com under Security. Revoking access stops all further reads at once.
Offboarding Risk Scan
Microsoft GraphReads leaver-relevant evidence (disabled users, sign-in activity, OAuth grants, roles, devices, drives, sharing) to build an offboarding evidence pack. No remediation permission is requested.
A Microsoft 365 tenant administrator approves the connection. Every permission below is read-only.
| Permission | Why it is requested | Access | What is stored | Never stored |
|---|---|---|---|---|
User.Read.All | Read the user list and account status to find disabled or lingering leaver accounts. | Read-only | Counts and posture flags for the report shown to your administrator. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
AuditLog.Read.All | Read sign-in activity to show whether a departed account is still being used. | Read-only | Counts and posture flags for the report shown to your administrator. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
Directory.Read.All | Read service principals and OAuth grants a leaver may still hold. | Read-only | Counts and posture flags for the report shown to your administrator. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
Application.Read.All | Read the application detail behind those grants. | Read-only | Counts and posture flags for the report shown to your administrator. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
Organization.Read.All | Read tenant and licence context for the evidence pack. | Read-only | Licence and tenant figures for the report. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
Policy.Read.All | Read the Conditional Access posture that governs leaver access. | Read-only | Policy posture flags for the report. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
RoleManagement.Read.Directory | Read directory role assignments to catch privileged roles left on a leaver. | Read-only | The count of privileged assignments for the report. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
DeviceManagementManagedDevices.Read.All | Read the Intune managed-device inventory to confirm a leaver has no device left active. | Read-only | Managed-device counts for the report. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
SecurityEvents.Read.All | Read security alerts relevant to the offboarding evidence pack. | Read-only | Security-alert counts for the report. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
Files.Read.All | Read OneDrive and SharePoint drive presence for leavers: drive type and quota, to flag data left behind. | Read-only | Drive presence and quota state per flagged account, for the report. | The contents of documents are not read; only drive type and quota state are summarised, and raw identities are digested before logging. |
SharePointTenantSettings.Read.All | Read the tenant external-sharing posture. | Read-only | External-sharing posture flags for the report. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
How long it is kept
The scan result is held in a short-lived server session for ten minutes to render your report and evidence pack, then it expires. Nothing is retained long-term.
How to revoke
A tenant administrator can remove the grant at any time in the Microsoft Entra admin center, under Enterprise applications, by deleting the ITSailor application. Revoking access stops all further reads at once.
Microsoft 365 Security Scorecard
Microsoft GraphReads Conditional Access, Security Defaults, admin roles, PIM, app-consent policy, Intune enrolment, and SharePoint sharing to verify posture against the ITS-M365 baseline.
A Microsoft 365 tenant administrator approves the connection. Every permission below is read-only.
| Permission | Why it is requested | Access | What is stored | Never stored |
|---|---|---|---|---|
User.Read.All | Read the user roster to size the tenant and check per-user posture. | Read-only | Aggregate scorecard metrics for the drift trend. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
Directory.Read.All | Read directory objects for app-consent and service-principal posture. | Read-only | Aggregate scorecard metrics for the drift trend. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
Policy.Read.All | Read Conditional Access and the authorization (app-consent) policy. | Read-only | Policy posture flags, as aggregate scorecard metrics. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
RoleManagement.Read.Directory | Read role assignments and PIM eligibility to check the standing Global Administrator count. | Read-only | The count of standing Global Administrators, as an aggregate metric. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
AuditLog.Read.All | Read sign-in activity for MFA and legacy-authentication signals. | Read-only | Aggregate scorecard metrics for the drift trend. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
SecurityEvents.Read.All | Read Microsoft Secure Score as advisory context. | Read-only | Secure Score figures, as advisory context in the report. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
DeviceManagementManagedDevices.Read.All | Read Intune enrolment to verify device-management coverage. | Read-only | Enrolment coverage figures, as aggregate metrics. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
SharePointTenantSettings.Read.All | Read the external-sharing posture. | Read-only | External-sharing posture flags, as aggregate metrics. | Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs; the raw values are not retained. |
offline_access | Reserved so a scheduled re-scan could refresh its own access token without a fresh sign-in. Scheduled re-scans are not enabled for the scorecard yet. | Read-only | Nothing today. The scorecard scan does not retain your sign-in token; this permission is held in reserve for scheduled re-scans, which are not enabled yet. | No directory data. This permission carries no read access, only the ability to refresh an access token. |
How long it is kept
The live scan produces aggregate scorecard metrics (percentage, band, gap counts, per-control verdicts) kept for up to 180 days for the drift trend, keyed to an opaque random token in your browser, not your email. No identities are stored.
How to revoke
A tenant administrator can remove the grant at any time in the Microsoft Entra admin center, under Enterprise applications, by deleting the ITSailor application. Revoking access stops all further reads at once.
Sub-processors
The sub-processors ITSailor relies on, condensed from the Privacy Policy. The policy is the authoritative source and is updated first when this list changes.
| Processor | Purpose | Jurisdiction |
|---|---|---|
| Stripe Payments Europe Ltd. | Payment processing and subscription billing | Ireland (EU) |
| Resend, Inc. | Transactional email delivery | USA (EU-US DPF, SCCs fallback) |
| Upstash, Inc. | Managed storage for newsletter and rate-limit state | USA (DPA and SCCs) |
| Hetzner Online GmbH | Production server hosting and backups | Germany (EU) |
| Cloudflare, Inc. | DNS, CDN, and Zero Trust Tunnel | USA (EU-US DPF, SCCs; EU edge nodes) |
| Vercel, Inc. | Frontend hosting and edge logs | USA (EU-US DPF, SCCs; EU edge preferred) |
| Plausible Insights OÜ | Cookie-free website and conversion analytics | EU |
| GitHub, Inc. | Private repository hosting and tool authentication | USA (EU-US DPF under the Microsoft umbrella, SCCs) |
| Anthropic (Claude API) | SaaS Auditor briefs from aggregate figures, contract-document extraction, internal Ops Log drafting | Outside the EEA (SCCs; no framework claimed) |
| OpenAI (API) | Free-tool diagnostic report and the weekly Platform Health Briefing | Outside the EEA (SCCs; no framework claimed) |
| Cal.com | Scheduling for discovery calls, demos and paid workshop sessions | Outside the EEA (SCCs; no framework claimed) |
| DocRaptor | Rendering purchased eBook PDFs, which carry the buyer email in the licence line | Outside the EEA (SCCs; no framework claimed) |
| Google LLC (reCAPTCHA) | Abuse and fraud risk analysis on public contact and scan-request forms | USA (Google's applicable transfer safeguards) |
| Microsoft Ireland Operations Limited | Microsoft 365 services where you purchase through us via Pax8 | Ireland (EU) |
| Pax8 Inc. | Microsoft 365 licensing marketplace | EU operations (Netherlands) |
Documents
A Data Processing Agreement (DPA) covering this processing is available on request during scoping. The controller-to-processor terms follow the requirements of GDPR Article 28.