Read permissions only
A run asks Microsoft for read permissions and nothing else. The consent card in the app shows which were granted, and a missing one leaves its part out, said so in the document.
It reads your configuration. It changes nothing.
GlacierPoint Atlas describes how your tenant is set up, so it reads settings, policies and counts. It holds no access to your tenant, and the work is done by an app on your computer, signed in as you.
Access
Who can touch the tenant.
Only people in your organization, with their own sign-in, and, for scheduled runs, an app registration your organization owns.
No vendor access
We hold no password, token, client secret or certificate for any tenant, and there is no support account or back door. Nobody at GlacierPoint can read or change your tenant.
Sign-ins stay with the app
You sign in to Microsoft in your browser. The sign-in is used by the app on your computer and never sent to the portal; a scheduled run asks for a fresh token every time and keeps none.
The one write, named honestly
Scheduled runs need an app registration of your own, “GlacierPoint Atlas scheduled run”. The setup shows you every object before it is created, writes only to your directory, removes its own write permissions when it is done, and keeps a journal on your computer. Remove takes it all away.
Scheduled runs on your computer
A Windows task on a computer you choose, with a certificate made there whose private key Windows keeps and will not export. The schedule never lives at the portal, so the portal never holds a key to your tenant.
The portal never steers the app
What the app reads is fixed in the app. The portal receives runs; it cannot make the app read something else or run anything.
Your runs and documents
Encrypted before they leave your computer.
What a run carries: settings, policies and counts. What the portal does with it: the document.
- Sealed uploads. A run is compressed and encrypted on your computer with AES-256-GCM, under a key wrapped with the portal’s public key (RSA-OAEP), and bound to its tenant and run before it is uploaded.
- Encrypted at rest. The portal stores every row encrypted under a data key kept outside the database, so a copy of the database alone reveals nothing.
- Narrative written locally. The sentences of the document are generated on the portal from your run. No external AI service sees your data, and we never train AI on customer data.
- Names only where you allow. People’s names appear in the document only where your plan and your workspace’s conceal-names switch allow.
- Diagnostics without names. Error reports carry the status and the error code of Microsoft, never a token and never a user’s name.
Permissions
Every permission, by name.
Asked at sign-in, as delegated permissions; a scheduled run has the same reads as application permissions, and nothing that writes.
| Permission | What it reads |
|---|---|
Directory.Read.All | The directory: organization, domains, roles and their assignments, synchronization |
Policy.Read.All | Conditional Access policies, named locations, authentication methods and strengths, cross-tenant access |
Application.Read.All | Applications and service principals, with the number of credentials each holds (never their values) |
Domain.Read.All | Your domains, their verification and federation state |
Organization.Read.All | The organization and its subscriptions |
RoleManagement.Read.Directory | Directory roles, their assignments and eligible assignments |
Group.Read.All | Groups, counted by kind |
User.Read.All | Users, counted, with their attributes; names appear in the document only where your plan and your workspace switch allow |
DeviceManagementConfiguration.Read.All | Intune compliance and configuration policies, update rings and app protection policies |
DeviceManagementManagedDevices.Read.All | Managed device counts by platform and compliance state |
DeviceManagementServiceConfig.Read.All | Enrollment restrictions and Autopilot profiles |
DeviceManagementRBAC.Read.All | Intune roles |
| Exchange Online, read | Mail flow and mail protection: connectors, rules, DKIM, anti-spam, anti-malware, anti-phish, Safe Links, Safe Attachments, quarantine and allow and block lists |
| Security and Compliance, SharePoint Online and Teams PowerShell, read | Information protection and collaboration: labels, data loss prevention, retention, sharing and Teams policies |
The setup of scheduled runs signs in once with Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All and DelegatedPermissionGrant.ReadWrite.All to create your app registration and grant its read permissions, then takes these three back out of the consent at the end of every setup, renewal and removal.
What we never hold
Not on our servers, not anywhere.
If we do not hold it, it cannot leak from us.
- The value of any secret, or the private key of any certificate: Microsoft does not return them and the app does not ask
- Passwords, tokens, client secrets or certificates that would let us into your tenant
- Mail, files, chats, messages or sign-in logs: user content is never read
- The DNS traffic of your computer: only the records looked up, as text
- The private key of the scheduled run’s certificate: it stays in Windows on your computer
- Any write to your tenant’s data: the document describes, it never fixes
The website and the portal
Nothing loaded from anyone else.
No trackers, no analytics, no advertising, no third-party scripts or fonts.
A strict Content-Security-Policy
Every page, this one included, may run only scripts and styles served by the portal itself, and cannot be framed by another site.
Sessions that end
Roles decide who may connect apps, change settings, add notes and invite people: owner, operator or viewer. Signing in uses your GlacierPoint account, with a code sent to your address and no password.
Found a security problem? Write to security@glacierpointtech.com; how to report a vulnerability says what to send and what to expect.