Installation

This page installs IntensiveReports on a Windows server with IIS. Check the requirements first. Plan about an hour, plus up to 30 minutes for Microsoft 365 to accept the new permissions.

The examples use these names; change them to yours:

Name	Example
Site folder	D:\Sites\IntensiveReports
IIS site and app pool	IntensiveReports
Address	https://reports.example.com
App pool identity	NETWORK SERVICE

The release package

You receive IntensiveReports as a zip file, IntensiveReports-<version>.zip:

Content	What it is
app\	the web application. Its content goes into the IIS site folder.
appsettings.template.json	every setting with placeholders. It becomes appsettings.json in the site folder.
setup\	the PowerShell scripts for modules, certificate, permissions, the optional API app registration and IIS
VERSION.txt	version and build date
README.txt	where this documentation is

Copy the zip to the server and unblock it before you extract it, so Windows runs the scripts:

Unblock-File C:\Temp\IntensiveReports-<version>.zip
Expand-Archive C:\Temp\IntensiveReports-<version>.zip -DestinationPath C:\Temp\IntensiveReports
cd C:\Temp\IntensiveReports

1. Prepare the server

In PowerShell as administrator, add IIS with WebSockets and Application Initialization:

Install-WindowsFeature Web-Server, Web-WebSockets, Web-AppInit -IncludeManagementTools

Then install:

1. the ASP.NET Core 10 Hosting Bundle from Microsoft’s .NET 10 download page. Restart IIS afterwards (iisreset), so it loads the ASP.NET Core module;
2. PowerShell 7.4 or later, if pwsh is not installed yet:

# in Windows PowerShell, as administrator
iex "& { $(irm https://aka.ms/install-powershell.ps1) } -UseMSI -Quiet"

2. Install the PowerShell modules

In PowerShell 7 (pwsh) as administrator:

.\setup\Install-IrModules.ps1

It installs, for all users (so the app pool finds them whatever account it runs as):

• the Microsoft Graph modules, all pinned to the same version;
• ExchangeOnlineManagement (Exchange Online and Purview);
• PnP.PowerShell (SharePoint);
• MicrosoftTeams.

It ends with one OK <module> <version> line per module. A FAIL line names the module that did not load.

3. Create the app registration

Follow Entra app registration: create the registration, the certificate (on this server), the client secret, and grant the permissions. Note the tenant ID, client ID, secret value and certificate thumbprint.

4. Copy the application

New-Item -ItemType Directory -Force D:\Sites\IntensiveReports
Copy-Item .\app\* D:\Sites\IntensiveReports -Recurse
Copy-Item .\appsettings.template.json D:\Sites\IntensiveReports\appsettings.json

5. Create the app pool and the site

In IIS Manager:

1. Application Pools > Add Application Pool: name IntensiveReports, .NET CLR version No Managed Code.
2. The new pool > Advanced Settings: Identity NetworkService (or keep ApplicationPoolIdentity), Load User Profile True.
3. Sites > Add Website: name IntensiveReports, application pool IntensiveReports, physical path D:\Sites\IntensiveReports, binding https, host name reports.example.com, your TLS certificate.

Or in Windows PowerShell 5.1 as administrator (the IIS: drive is not available in PowerShell 7):

Import-Module WebAdministration
New-WebAppPool -Name 'IntensiveReports'
Set-ItemProperty 'IIS:\AppPools\IntensiveReports' -Name managedRuntimeVersion -Value ''
Set-ItemProperty 'IIS:\AppPools\IntensiveReports' -Name processModel.identityType -Value NetworkService
Set-ItemProperty 'IIS:\AppPools\IntensiveReports' -Name processModel.loadUserProfile -Value $true

New-Website -Name 'IntensiveReports' -PhysicalPath 'D:\Sites\IntensiveReports' -ApplicationPool 'IntensiveReports' `
    -HostHeader 'reports.example.com' -Port 443 -Ssl -SslFlags 1
(Get-WebBinding -Name 'IntensiveReports' -Protocol https).AddSslCertificate('<tls-certificate-thumbprint>', 'My')

If the app pool uses its own identity instead of NETWORK SERVICE, the account is IIS AppPool\IntensiveReports in every step below, and the certificate script needs -AppPoolIdentity 'IIS AppPool\IntensiveReports'.

6. Give the app pool its folder rights

The app pool identity reads the site folder and writes App_Data and the log folder:

$Identity = 'NETWORK SERVICE'   # or 'IIS AppPool\IntensiveReports'
New-Item -ItemType Directory -Force D:\Sites\IntensiveReports\App_Data, C:\IntensiveReportsLogs
icacls D:\Sites\IntensiveReports /grant "${Identity}:(OI)(CI)RX"
icacls D:\Sites\IntensiveReports\App_Data /grant "${Identity}:(OI)(CI)M"
icacls C:\IntensiveReportsLogs /grant "${Identity}:(OI)(CI)M"

The certificate’s private key was granted in step 3 by New-IrCertificate.ps1.

7. Keep the app running

IntensiveReports keeps its data in memory. Stop IIS from shutting the app down when nobody uses it:

.\setup\Set-IrIisAlwaysRunning.ps1 -SiteName 'IntensiveReports'          # shows the current settings
.\setup\Set-IrIisAlwaysRunning.ps1 -SiteName 'IntensiveReports' -Apply   # changes them

With -Apply it sets the app pool to AlwaysRunning, idle time-out 0 and no regular recycle, and turns on preload for the site, so the app starts loading data after a restart without waiting for a visitor. Run it as administrator. It also lists the app pool’s recent stops, which helps when data seems to disappear.

8. Fill in appsettings.json

Open D:\Sites\IntensiveReports\appsettings.json and replace every value in angle brackets: tenant ID, client ID, secret, certificate thumbprint, <tenant>.onmicrosoft.com, the SharePoint admin address and your host name. Leave RequireSignIn on true. Every key is explained in Configuration.

Caution

Set AllowedHosts to the host name people use (reports.example.com). If it still says <your-host>, the site answers every request with an error.

9. Start and check

1. Open https://reports.example.com. The page frame appears at once; the reports fill in while the app reads your tenant for the first time (about a minute on a small tenant, longer on a large one).
2. Sign in with Log in in the top right. If sign-in fails, the page names the error code and the fix (Troubleshooting).
3. As an administrator, open PowerShell Diagnostics at the bottom of the menu (/PsDiagnostics). It should report no warm-up errors. Press Run probe: it connects to Exchange Online the way the reports do.
4. Open Settings > Data & cache. No data source should show an error. A failed one shows the reason under Last error.
5. Open one report per workload: a user report in Entra ID, a mailbox report in Exchange Online, a SharePoint site report. If one shows a red load error, its ? button names the permission or licence it needs.

Note

Exchange Online and SharePoint can need up to 30 minutes after the permissions were granted. If only those reports fail, wait, then recycle the app pool.

Next steps

• Decide who may open the app: Sign-in and access.
• Give IT staff the administrator role: Entra app registration.
• Set up backups: Operations.
• Optional: Report API and MCP.