The Windows app reads your tenant with your own sign-in, and the portal writes the document from the run. Here is every step, what is read, and what runs where.
The first run takes a few minutes. Every later run is the same, by hand or on a schedule.
Create your workspace on the sign-up page with your work email and the name of your organization. We email a six-digit code; there is no password to keep.
Download the app from the portal and start it on a Windows computer. It shows a one-time code; an owner or operator approves it in the portal, and the app is connected to your workspace.
Sign in to Microsoft in your browser. The consent card shows which read permissions were granted. The app reads, then seals the result on your computer and uploads it.
The document opens in the portal: the cover and summary, then the ten sections with their figures. Your notes are added there, and the PDF and the Word file carry them in the next document.
Six sections open with a figure; the others open with their headline table. The numbering never changes between documents.
The organization, its domains, the workloads in use, the subscriptions, and who holds which administrator role.
What is read: The organization, its domains, the subscriptions, the directory roles and their assignments, eligible assignments in Privileged Identity Management, and the admin consent settings.
Figure: Tenant topology: domains, workloads in use, administrator roles
Users and groups by count and kind, applications and service principals, on-premises synchronization, federation and cross-tenant access.
What is read: User counts and attributes, groups by kind, applications and service principals with the number of credentials each holds, directory synchronization, federation and cross-tenant access settings.
Figure: Identity sources: on-premises sync, federation, guest access
Conditional Access policies, named locations, authentication methods and strengths, security defaults.
What is read: Conditional Access policies, named locations, the authentication methods policy and authentication strengths, security defaults, and Privileged Identity Management settings.
Figure: Conditional Access map: who, from where, to what, with what grant
Accepted and remote domains, connectors, transport rules, DKIM, SPF, DMARC and MX as published, forwarding.
What is read: Accepted and remote domains, inbound and outbound connectors, transport and journal rules, DKIM signing, mailbox forwarding, and the organization and transport configuration; SPF, DMARC and MX are looked up from your computer as the Internet sees them.
Figure: Mail flow: inbound and outbound paths through connectors and gateways
Anti-spam, anti-malware, anti-phish, Safe Links and Safe Attachments, preset policies, quarantine, allow and block lists.
What is read: The Defender for Office 365 policies: anti-spam, anti-malware, anti-phish, Safe Links, Safe Attachments, the preset security policies, quarantine policies, and the tenant allow and block lists.
Figure: Protection pipeline: the order mail passes the filters
Sensitivity labels and their policies, data loss prevention, retention.
What is read: Sensitivity labels and label policies, data loss prevention policies, retention policies and labels.
Figure: none in this release
Second release: until then this section prints as a one-page note that names the PowerShell module it needs.
Intune compliance, configuration, enrollment, update rings, app protection, filters and roles, with device counts.
What is read: Compliance policies, configuration and settings catalog policies, enrollment restrictions and Autopilot profiles, update rings, app protection policies, assignment filters and Intune roles; device counts by platform and compliance state.
Figure: Device management: enrollment paths, compliance to Conditional Access
SharePoint and OneDrive sharing, Teams meeting, messaging and external access.
What is read: SharePoint and OneDrive sharing settings, and the Teams meeting, messaging and external access policies.
Figure: none in this release
Second release: until then this section prints as a one-page note that names the PowerShell module it needs.
Subscriptions, seats, assigned and unassigned, service plans on or off.
What is read: Each subscription with its seats, how many are assigned, and which service plans are on or off.
Figure: none in this release
Directory role members, partner (GDAP) relationships, service principals that hold directory roles.
What is read: Who holds each directory role, the partner relationships with delegated administration, and the service principals that hold directory roles.
Figure: Shown in the figure of section 1
The appendix closes every document: the change log since the previous document, the register of what was not collected, and a glossary.
Most sections are read through Microsoft Graph with your sign-in. Mail flow and mail protection also need the Exchange Online PowerShell module; information protection needs the Security and Compliance module; collaboration needs the SharePoint Online and Teams modules.
When a module is not installed, or the sign-in cannot read something, the document does not leave a hole and does not guess: the section prints as a note with fixed wording that says what was not collected and which module or permission it needs, and the appendix lists every such note.
SPF, DMARC and MX records live outside your tenant, so the app looks them up as the Internet sees them, for every verified domain that sends mail. It asks public resolvers and falls back to your computer’s own resolver when none answers; a setting of the app prefers your internal resolver instead. The document names the resolver that answered.
The portal receives the records as text, never the DNS traffic itself.
A document is a point in time, and monthly is the rhythm a change log reads well at. A paid tenant is documented once a month without anyone at the keyboard. The schedule lives on a computer of yours, never at the portal:
After each scheduled run the portal writes the new document, works out the change log against the one before, and mails your team that it is ready, with the number of changes in the subject.
Signs in to Microsoft as you, reads, looks up the DNS records, seals the result and uploads it. For scheduled runs it holds the certificate and the Windows task. It never asks the portal what to read.
Opens the sealed run, writes the sentences from the facts of the run, lays out the diagrams, renders the pages, the PDF and the Word file, and keeps the documents your plan includes. No external AI service is used, and the portal holds no credential for your tenant.
The free Preview runs up to 2 times on one tenant: the summary, section 1 in full, and the headline tables and diagrams of the rest. Decide with your own tenant in front of you.