Overview
IntensiveReports runs on your own Windows server. It reads your Microsoft 365 tenant with an app registration you create, builds the reports in memory and shows them to people in their browser. This section is for the administrator who installs and runs it.
The parts
Section titled “The parts”| Part | What it is |
|---|---|
| Web app | One ASP.NET Core application hosted in IIS. People open it in a browser; there is nothing to install on their computers. |
| App registration | One Entra ID app registration in your tenant. It holds the application permissions IntensiveReports reads with, a client secret and a certificate. See Entra app registration. |
| PowerShell modules | Microsoft Graph, Exchange Online, PnP (SharePoint) and Microsoft Teams modules, installed on the server. Some reports read through them. |
| Certificate | In the server’s machine certificate store. The PowerShell modules sign in with it. |
appsettings.json | The server’s configuration file in the site folder: tenant, app registration, sign-in and security settings. See Configuration. |
App_Data folder | Settings made in the app, the dashboard history and the API clients. See What is stored on disk. |
| Log folder | One log file per day, C:\IntensiveReportsLogs\ unless you change it. |
There is no database. SQL Server is not needed.
How data flows
Section titled “How data flows”- When the app starts, it signs in to Microsoft 365 as the app registration (app-only, no user involved).
- It reads the core data (users, groups, devices, licences, Conditional Access policies and more) in the background. The first pages are usable while this runs.
- A timer keeps every data set current. Each one has its own refresh interval, from 5 minutes to 6 hours.
- Reports that need slow calls or PowerShell load when someone first opens them and are then kept for a while. Scans run only when someone starts them.
- People see the results in their browser. Exports (CSV, Excel, PDF), the report API and the MCP server read the same data.
Details and intervals: Data and cache.
Read-only towards your tenant
Section titled “Read-only towards your tenant”IntensiveReports only reads. No report changes anything in Microsoft 365. The permissions are application permissions with admin consent, almost all of them read-only. A few Microsoft APIs have no read-only permission for the data some reports need; those permissions are not granted unless you ask for them with a switch of the setup script (Entra app registration).
Data lives in memory
Section titled “Data lives in memory”The data read from Microsoft 365 is kept in the server’s memory only. It is never written to disk.
- When the app restarts (an update, an app pool recycle, a server reboot), the data is gone and the app reads it again. Pages show a loading state until their data is back.
- Results of on-demand reports and scans are gone too. Scans must be run again.
- IIS stops an idle app pool after 20 minutes by default. Set the pool to always running so this does not happen (Requirements).
What is stored on disk
Section titled “What is stored on disk”| What | Where | Written by |
|---|---|---|
| Settings for everyone (thresholds, cache, display defaults) | App_Data\IntensiveReports.settings.json, plus the built-in defaults and the version before the last save next to it | administrators, on the Settings page |
| Dashboard history (trend charts) | App_Data\IntensiveReports.history.json, 400 days | the app, after each refresh of a dashboard figure |
| API clients and the API on/off switch | App_Data\IntensiveReports.api-clients.json | administrators, Settings > API access |
| API audit log | App_Data\api-audit\<date>.jsonl, one line per call, 90 days | the app |
| Licence prices for the chargeback report | a JSON file in App_Data | the licence chargeback report |
| Log | <LoggingRootPath>\IntensiveReports<date>.txt, 31 files | the app |
| Personal preferences (theme, language, date format) | a cookie in each person’s browser | each user |
Back up the App_Data folder and appsettings.json (Operations). An update never
touches them (Updating).
Who talks to whom
Section titled “Who talks to whom”| From | To | Why |
|---|---|---|
| People’s browsers | your IntensiveReports site (HTTPS, WebSockets) | the app itself |
| People’s browsers | login.microsoftonline.com | signing in |
| The server | login.microsoftonline.com | tokens for the app registration |
| The server | graph.microsoft.com | most reports |
| The server | Exchange Online, SharePoint Online, Microsoft Teams and Microsoft Purview endpoints | reports that read through PowerShell |
| The server | management.azure.com, api.bap.microsoft.com, api.powerapps.com, api.flow.microsoft.com, api.security.microsoft.com, api.securitycenter.microsoft.com, ai.azure.com | Azure, Power Platform, Defender and AI agent reports (only if you use them) |
| The server | download.microsoft.com | Microsoft’s list of licence product names |
| Scripts and AI assistants | your site’s /ir-api/v1 and /ir-mcp | the report API and MCP server, off until you switch it on |
All connections are outbound HTTPS (port 443). Nothing in Microsoft 365 connects to your server.