Does it need Global Administrator?
No. The audit runs on read-only Microsoft Graph permissions. A Global Administrator is only needed once, to consent to the application registration — the same consent any read-only tool requires. After that, the audit account holds no privileged role.
How many tenants does it cover?
There is no limit, because there is nothing to meter. The application manages client companies side by side, each with its own connectors, history and branding, and the purchase covers as many as you ever open — one or five hundred.
Exactly which permissions are we granting?
Five read scopes on Microsoft Graph — Directory.Read.All, Policy.Read.All, RoleManagement.Read.All, Reports.Read.All and AuditLog.Read.All — plus the built-in Reader role if you audit Azure, and a standard read-only domain account for on-premises Active Directory. No write scope is requested anywhere, which your client can confirm on their own consent screen. The full table is here.
Does anything leave our network?
Only the API calls to Microsoft, made from your workstation. There is no vendor backend, no analytics, and no upload of findings. Reports are files on your disk until you choose to send them.
What if a client runs on-premises Active Directory?
It's covered — 58 controls over domain policy, privileged groups, delegation, Kerberos and stale accounts, queried over LDAP or LDAPS with a read-only service account.
Can we add our own controls?
Yes. The catalog loads from control packs, and you can import additional packs alongside the official ones. Custom checks can be defined declaratively against Graph, ARM or LDAP.
How long does an audit take to run?
Seconds, not hours. A 194-control run across six Microsoft services completes in about sixteen seconds on a normal workstation, because the controls are direct API reads rather than scripts spawning sessions. The time in an engagement goes into consenting the connectors and reading the findings, not waiting for the tool.
Does running controls in parallel risk throttling a client's tenant?
No. The connectors that talk to Graph, Azure and Exchange self-limit whatever you set the thread count to, so the worst case of an over-ambitious setting is a slower audit rather than a throttled tenant. The default is eight concurrent controls, adjustable from one to sixteen, and a built-in benchmark measures the optimum on your own machine.
Can we see it working before buying?
Yes, and you should. We run a full audit against one tenant of yours, with your engineers watching, and you keep the reports whatever you decide afterwards. For a purchase of this kind there is also a technical review of the codebase before signature.
Is there really only one price?
Yes. One figure, the same for a two-person consultancy and for a group with forty offices, covering the product, the source code and the right to exploit it commercially without restriction. There is no tier above it and nothing held back to sell you later. The only optional extra is an annual maintenance contract, and the product works without it.
Is the source code included?
Yes, in full, with the build and packaging chain, the control catalog and its framework mappings, the report templates and the technical documentation. You are not licensing a binary — your engineers can compile, modify and extend it without asking us anything.
How do our own clients activate it?
You generate the key yourself, with the licence generator that ships with the product: a client name, a validity in days and a maximum number of tenants. Your customer pastes it into the activation screen and the application is operational immediately, with no restart. We are not involved in any of it and never learn who your customers are.
Can we resell it to our own clients?
You can do better than resell it: you own it, so you sell your own product at your own price under your own name. There is no reseller agreement, no margin schedule and no revenue share, because after the purchase there is nothing linking your sales to us.
Is there any support after the sale?
Yes, and all of it optional. Our engineers take evolution requests on demand — new controls, new connectors, report changes — and we can supply a complete application guide, the technical documentation, a professional website for the product under your name, and the blog content behind it. Priced separately; the product needs none of it to work.
Are you open to investment or an acquisition?
Yes, and to structures short of a full sale — an equity stake, a funded roadmap, or exclusive distribution. Financials, architecture documentation and a code walkthrough are available under NDA. Ask through the form and say which structure interests you.
