Operations

Check health

There is no single health page. Use these:

Where	What it tells you
Settings > Data & cache (administrators)	every data set with its last refresh, state and Last error; the server’s memory
PowerShell Diagnostics (/PsDiagnostics, administrators)	whether the PowerShell connections at start worked, the module versions, and a live test (Run probe) that connects to Exchange Online the way the reports do. Re-run warm-up (reconnect) reconnects without restarting the app.
The header	Refreshing n data sources while data is being loaded; it links to Settings > Data & cache
GET /ir-api/v1/status	state and freshness of every report a client may read, for monitoring tools. Needs the report API and a client (Report API and MCP).
The log	errors and warnings, see below

Logs

The app writes one log file a day to the log folder (C:\IntensiveReportsLogs\ unless set with IntensiveReportsConfig:LoggingRootPath): IntensiveReports<date>.txt. A file that reaches 100 MB is continued in a new one; the last 31 files are kept. It contains information, warnings and errors of the app and the web server. If the log itself cannot be written, the reason is in IntensiveReports_SerilogErrors.txt in the same folder.

Useful lines:

Line contains	Meaning
items retrieved	a data set was loaded, with its number of items
Error / Warning	something failed; the line names the data set or report
Sign-in failed	a failed sign-in with Microsoft’s full message
Security - AllowedHosts is '*'	AllowedHosts is not set (Configuration)

When a user sees a short error reference instead of an error text, search the log for that reference.

Renew the certificate

The certificate from New-IrCertificate.ps1 is valid for 2 years. When it expires, every Exchange, SharePoint, Teams and Purview report fails. Before it expires:

1. Run .\setup\New-IrCertificate.ps1 again on the server (with the same -AppPoolIdentity).
2. Upload the new .cer in the app registration (Certificates & secrets > Certificates).
3. Put the new thumbprint into MsGraphCredentials:CertificateThumbprint and restart the app.
4. Check PowerShell Diagnostics, then delete the old certificate from the app registration and from the server’s certificate store.

Renew the client secret

A client secret expires after the time you chose when you created it. When it expires, every Graph report fails at once. Before it expires:

1. Create a new secret in the app registration (Certificates & secrets > Client secrets).
2. Put the value into MsGraphCredentials:ClientSecret and EntraID:ClientSecret and restart the app.
3. Check that reports load, then delete the old secret.

Do the same at once if a secret may have leaked. A calendar reminder a month before each expiry date helps.

Tip

The report App & Service Principal Credential Expiry lists the app registrations whose secrets or certificates expire soon, including IntensiveReports’ own.

API clients

API clients expire after the number of days set when they were created (365 by default). Check Settings > API access for clients that expire soon or were not used for a long time (Last used), and remove those you do not need (Report API and MCP). The IntensiveReports API app registration’s client secret, if you created one, expires after 6 months unless you chose otherwise.

Back up

Back up these regularly, for example with your server backup:

What	Why
appsettings.json in the site folder	your configuration, including the secret: store the backup securely
the App_Data folder in the site folder	settings made in the app, dashboard history (400 days), API clients and the API audit log
the certificate with its private key	only needed if you would rather restore it than create a new one

The program files need no backup: the release package contains them. Data read from Microsoft 365 is never stored, so there is nothing else to back up.

To restore, install the same version (Installation), then put appsettings.json and App_Data back before the first start.

Watch memory

Settings > Data & cache shows how much memory the app uses. The figure grows while people open reports and levels off once every report they use has been loaded. Press Measure now for an exact figure (the app pauses for a moment for a full clean-up).

If the server runs short of memory, add memory, choose a slower refresh pace, shorten Keep on-demand reports for, or switch off data sets you do not need.

Avoid cold starts

The data lives in memory. When IIS stops or recycles the app pool, the next visitor waits while the app reads the tenant again, and scan results are gone. IIS does this after 20 idle minutes and every 29 hours by default.

.\setup\Set-IrIisAlwaysRunning.ps1 -SiteName 'IntensiveReports'          # shows the settings and recent app pool stops
.\setup\Set-IrIisAlwaysRunning.ps1 -SiteName 'IntensiveReports' -Apply   # always running, no idle stop, no regular recycle, preload

If data still disappears, the script’s list of recent stops (from the Windows System log) shows when and why the pool stopped.

Rotate other credentials

Credential	Where it is used	How to replace it
TLS certificate of the site	IIS binding	as for any IIS site
API tokens	scripts and tools	New token on the client, then update the script
Certificate API clients	the client’s own certificate	Edit the client and upload the new public certificate