Configuration

IntensiveReports reads its configuration from appsettings.json in the site folder. The release package contains appsettings.template.json with every key below; copy it to the site folder as appsettings.json and fill it in.

After a change, restart the app: recycle the app pool, or save web.config in the site folder unchanged (IIS restarts the app when that file changes). A restart empties the in-memory data (Data and cache).

The template

{
  "EntraID": {
    "Instance": "https://login.microsoftonline.com/",
    "TenantId": "<directory-tenant-id>",
    "ClientId": "<application-client-id>",
    "ClientSecret": "<client-secret-value>",
    "CallbackPath": "/signin-oidc",
    "Domain": "<your-primary-domain>"
  },
  "MsGraphCredentials": {
    "TenantId": "<directory-tenant-id>",
    "ClientId": "<application-client-id>",
    "ClientSecret": "<client-secret-value>",
    "TenantDomain": "<tenant>.onmicrosoft.com",
    "CertificateThumbprint": "<certificate-thumbprint>",
    "SparePointSite": "https://<tenant>-admin.sharepoint.com"
  },
  "IntensiveReportsConfig": {
    "LoggingRootPath": "C:\\IntensiveReportsLogs\\",
    "Access": { "RequireSignIn": true, "ReaderRoles": "" },
    "DashboardAdminRole": "IR.Admin",
    "Security": { "Csp": "Enforce", "ErrorDetails": "SignedIn" },
    "Api": {
      "PublicUrl": "https://<your-host>",
      "RequestsPerMinute": 120,
      "AnonymousRequestsPerMinute": 20,
      "Entra": { "ApiAppId": "", "TenantId": "", "AccessRole": "IR.Api.Access" }
    },
    "PowerShellTimeoutMinutes": 20,
    "DocsUrl": "https://docs.intensivereports.com"
  },
  "Logging": { "LogLevel": { "Default": "Information", "Microsoft.AspNetCore": "Warning" } },
  "AllowedHosts": "<your-host>"
}

Replace every value in angle brackets. Backslashes in paths are written twice (C:\\IntensiveReportsLogs\\).

Tenant and app registration

Both sections name the same app registration (Entra app registration).

Key	Required	Value
`MsGraphCredentials:TenantId`	yes	the Directory (tenant) ID (a GUID). This is the tenant whose data the app shows.
`MsGraphCredentials:ClientId`	yes	the Application (client) ID
`MsGraphCredentials:ClientSecret`	yes	the client secret value
`MsGraphCredentials:CertificateThumbprint`	yes	the thumbprint of the certificate in `LocalMachine\My`
`MsGraphCredentials:TenantDomain`	yes	your `<tenant>.onmicrosoft.com` domain (used by Exchange Online, Purview and SharePoint PowerShell)
`MsGraphCredentials:SparePointSite`	yes	your SharePoint admin address, `https://<tenant>-admin.sharepoint.com`. The key is spelled SparePoint.
`EntraID:Instance`	yes	`https://login.microsoftonline.com/`
`EntraID:TenantId`	yes	the tenant ID. If you leave it empty or write `organizations` or `common`, the app uses `MsGraphCredentials:TenantId`. Sign-in is always limited to that tenant.
`EntraID:ClientId`	yes	the same application (client) ID
`EntraID:ClientSecret`	yes	the same client secret value
`EntraID:CallbackPath`	yes	`/signin-oidc`
`EntraID:Domain`	no	your primary domain (for information)

Host and security

Key	Default	Meaning
`AllowedHosts`	`*` (any host)	the host name(s) people use to open the app, separated by `;`, for example `reports.example.com`. Requests for other host names are refused. With `*`, the app logs a warning at start and refuses certificate API clients unless `Api:PublicUrl` is set.
`IntensiveReportsConfig:Access:RequireSignIn`	`false`	`true`: every page needs a signed-in user of your tenant. Set it to `true` for every real tenant. See Sign-in and access.
`IntensiveReportsConfig:Access:ReaderRoles`	empty	app roles, separated by commas, of which a user needs one to open the app. Empty: every user of your tenant.
`IntensiveReportsConfig:DashboardAdminRole`	`IR.Admin`	the app role of IntensiveReports administrators. Global Administrators always qualify.
`IntensiveReportsConfig:Security:Csp`	`Enforce`	the Content Security Policy: `Enforce`, `ReportOnly` (browsers only report violations) or `Off`. The other security headers are always sent.
`IntensiveReportsConfig:Security:ErrorDetails`	`SignedIn`	`SignedIn`: full error texts only for signed-in users of your tenant; everyone else sees a short reference that is written to the log with the full text. `Everyone`: full texts for all.

Report API and MCP server

These only matter once you switch the API on (Report API and MCP).

Key	Default	Meaning
`IntensiveReportsConfig:Api:PublicUrl`	empty	this site’s public address, for example `https://reports.example.com`; several separated by `;`. Certificate API clients must name it as the token audience, and MCP clients that sign in with Entra ID find the sign-in through it. Empty: the address of the request, but only when `AllowedHosts` names the host.
`IntensiveReportsConfig:Api:RequestsPerMinute`	`120`	requests a minute per API or MCP client
`IntensiveReportsConfig:Api:AnonymousRequestsPerMinute`	`20`	requests a minute per address without a valid token
`IntensiveReportsConfig:Api:Entra:ApiAppId`	empty	the application ID of the IntensiveReports API app registration. Set it to let API and MCP clients sign in with Entra ID. Empty: Entra sign-in for the API is off.
`IntensiveReportsConfig:Api:Entra:TenantId`	the data tenant	the tenant of that app registration
`IntensiveReportsConfig:Api:Entra:AccessRole`	`IR.Api.Access`	the app role a caller needs

Logging, files and PowerShell

Key	Default	Meaning
`IntensiveReportsConfig:LoggingRootPath`	`C:\IntensiveReportsLogs\`	the log folder. The app writes `IntensiveReports<date>.txt`, one file a day (a new file after 100 MB), and keeps 31 files.
`Serilog`	none	optional: a standard Serilog section to change log levels or add log targets
`IntensiveReportsConfig:SettingsFilePath`	`App_Data\IntensiveReports.settings.json`	where the settings made in the app are stored. The API clients and the API audit log are stored next to it.
`IntensiveReportsConfig:HistoryFilePath`	`App_Data\IntensiveReports.history.json`	where the dashboard history is stored
`IntensiveReportsConfig:PowerShellTimeoutMinutes`	`20`	a PowerShell report is stopped after this many minutes (1 to 120)
`IntensiveReportsConfig:RunspacePoolSize:GraphRunspacePoolService`	`1`	parallel PowerShell sessions for Graph PowerShell (1 to 8)
`IntensiveReportsConfig:RunspacePoolSize:ExoGraphRunspacePoolService`	`3`	parallel PowerShell sessions for Exchange Online (1 to 8)
`IntensiveReportsConfig:DeviceNamePattern`	none	the device naming convention (a regular expression) when none is set in Settings > Report thresholds; the setting in the app wins

Documentation link

Key	Default	Meaning
`IntensiveReportsConfig:DocsUrl`	`https://docs.intensivereports.com`	the address of this documentation. The ? window of every report links to the report’s page here. Set your own address if you host a copy; set it to an empty value to hide the link.

Not needed

ConnectionStrings:DefaultConnection is not needed. IntensiveReports stores nothing in a database; leave the key out.

Settings in the app

Most day-to-day settings are made in the app on the Settings page, not in appsettings.json:

Tab	Who	What
Display, Regional & language, Export, Navigation	each user (“Only you”); on Display, administrators also set the Company default layout style	theme, language, date and number formats, table size, export options, menu
Report thresholds	administrators	the limits reports use, for example days without sign-in before a user counts as inactive. Each shows its default, allowed range and the reports that use it.
Data & cache	administrators	refresh pace, pausing background refresh, switching data sources off, how long on-demand reports are kept. See Data and cache.
API access	administrators	the report API and MCP server and their clients. See Report API and MCP.

Settings marked Only you are stored in the user’s browser and apply at once. Settings marked Everyone apply to every user and change only when an administrator presses Save. They are stored in App_Data (Overview). Below the tabs, administrators can reset all settings to their defaults or restore the previous settings.