Requirements

Check this list before you install. Everything here is needed unless it says optional.

Server

Item	Requirement
Operating system	Windows Server, in a version that Microsoft supports for .NET 10
Web server	IIS with the WebSocket Protocol feature (the app keeps a live connection to each browser) and, for always running, Application Initialization
.NET	the ASP.NET Core 10 Hosting Bundle (Microsoft’s download page for .NET 10). The app runs in-process in IIS.
PowerShell	PowerShell 7.4 or later (pwsh). Windows PowerShell 5.1 is not enough: the SharePoint module needs 7.4.
PowerShell modules	installed for all users with setup\Install-IrModules.ps1 from the release package (Installation)
Certificate	a certificate with private key in the machine store (LocalMachine\My) that the app pool can read. setup\New-IrCertificate.ps1 creates it (Entra app registration).
TLS certificate	a certificate for the site’s HTTPS binding (your usual web server certificate, not the one above)
Database	not needed

Memory and CPU

IntensiveReports keeps all data it reads in memory, so memory grows with the size of your tenant and with the number of reports people open.

As a reference: for a tenant with about 40 users, the app used about 0.8 GB after start and 1.2 to 1.4 GB with every report loaded. Large tenants need considerably more.

• Start with at least 4 GB of RAM for the app on a small tenant and 2 CPU cores, and more for thousands of users, groups or devices.
• Watch the memory line on Settings > Data & cache for the first weeks and size the server from it (Operations).

IIS app pool

Setting	Value	Why
.NET CLR version	No Managed Code	ASP.NET Core runs its own runtime
Load User Profile	True	the PowerShell modules need a user profile; without it they log access-denied warnings
Start mode	AlwaysRunning	the data lives in memory; a stopped pool loses it
Idle time-out	0 (never)	IIS stops an idle pool after 20 minutes by default
Regular recycle	off	a recycle empties the memory and every scan result
Identity	NETWORK SERVICE or the pool’s own identity (IIS AppPool\<pool name>)	it must read the certificate’s private key and write App_Data and the log folder

setup\Set-IrIisAlwaysRunning.ps1 -Apply sets start mode, idle time-out, recycle and preload for you (Installation).

Folders

The app pool identity needs Modify rights on:

• the App_Data folder in the site folder (settings, dashboard history, API clients and their audit log);
• the log folder, C:\IntensiveReportsLogs\ unless you set IntensiveReportsConfig:LoggingRootPath.

Network

The server needs outbound HTTPS (port 443) to Microsoft 365 and, for some reports, Azure:

• login.microsoftonline.com and graph.microsoft.com - always;
• Exchange Online, SharePoint Online (<tenant>-admin.sharepoint.com and your SharePoint sites), Microsoft Teams and Microsoft Purview - for the reports that read through PowerShell. Microsoft publishes the full address list for these services (“Microsoft 365 URLs and IP address ranges”);
• management.azure.com, api.bap.microsoft.com, api.powerapps.com, api.flow.microsoft.com, api.security.microsoft.com, api.securitycenter.microsoft.com and ai.azure.com - only for the Azure, Power Platform, Defender and AI agent reports;
• download.microsoft.com - Microsoft’s list of licence product names;
• the PowerShell Gallery - only while you install or update the modules.

If the server goes through a proxy, it must allow these addresses for the app pool identity.

Browsers

Current versions of Microsoft Edge, Google Chrome, Mozilla Firefox and Safari. JavaScript and WebSockets must be allowed for the site.

Microsoft 365 tenant

Item	Requirement
Who sets it up	a Global Administrator grants the permissions and the directory role once. Creating the app registration needs an Application Administrator or Cloud Application Administrator.
Licences	Microsoft 365 or Office 365 for the basics. Many reports need more: Entra ID P1 or P2 (sign-in data, Conditional Access, PIM), Intune, Defender, Purview and others. Each report’s page in the report reference names the licence it needs; the app shows the same under the ? button of every report. When a licence is missing, the report usually shows a load error that names it.
Directory role for the app	Global Reader (assigned by the setup script). Exchange Online and Teams PowerShell authorise app-only access by role.

For the report API and MCP server (optional)

Nothing extra on the server. You switch the API on in the app and create clients there (Report API and MCP). For sign-in with Entra ID instead of tokens you need a second app registration, created by setup\New-IrApiResourceApp.ps1.