Sign-in and access

IntensiveReports reads your whole tenant with the app registration’s permissions. Whoever can open the app sees what those permissions read. Decide deliberately who that is.

Require sign-in

"IntensiveReportsConfig": {
  "Access": { "RequireSignIn": true }
}

RequireSignIn	Effect
true	Every page needs a signed-in user of your tenant. Accounts of other tenants are refused. Guest users of your tenant count as users of your tenant; to keep them out, use reader roles (below).
false (built-in default)	Anyone who can reach the address can open every report without signing in. Use this only for a test tenant, or behind other access control (VPN, IIS IP restrictions).

The template in the release package sets true. Sign-in uses the app registration’s redirect URIs (Entra app registration).

The report API and MCP server do not use this setting: they are off until you switch them on, and every call needs its own token (Report API and MCP).

Limit access to some people

To let only some users of your tenant open the app, use an app role:

1. In the app registration, App roles > Create app role: for example display name IntensiveReports reader, allowed member types Users/Groups, value IR.Reader.
2. In Enterprise applications > IntensiveReports > Users and groups, assign it to the people or groups who may use the app.
3. In appsettings.json:

"IntensiveReportsConfig": {
  "Access": { "RequireSignIn": true, "ReaderRoles": "IR.Reader,IR.Admin" }
}

A user needs one of the listed roles. Users without one are refused after sign-in.

Caution

ReaderRoles also applies to administrators. List the administrator role too (as above), or give administrators the reader role as well; otherwise they cannot open the app either. Global Administrators are not exempt.

Administrators

An IntensiveReports administrator is a signed-in user of your tenant who is a Global Administrator or holds the app role IR.Admin (how to create it). Use IntensiveReportsConfig:DashboardAdminRole for another role name.

Only administrators can:

• save settings marked Everyone on the Settings page (thresholds, data and cache, the company default layout style) and reset or restore them;
• save a dashboard layout as the default for everyone;
• switch the report API on or off and manage its clients;
• open PowerShell Diagnostics (/PsDiagnostics), which shows module versions, the app’s IDs and connection errors.

Administrator rights need a signed-in user, also when RequireSignIn is false.

Error details

When a report fails, the page shows why. Some errors contain internal details (addresses, IDs, Microsoft’s error text).

IntensiveReportsConfig:Security:ErrorDetails	Effect
SignedIn (default)	the full text only for signed-in users of your tenant. Everyone else sees an 8-character reference; the full text is in the log next to the same reference.
Everyone	the full text for everybody

HTTPS

Run the site on HTTPS only. The app redirects HTTP requests to HTTPS and sends HSTS (browsers then refuse plain HTTP for the site). Bind your TLS certificate to the site in IIS (Installation).

Set AllowedHosts to the host name(s) people use, separated by ;. With *, the app answers for any host name, logs a warning at every start and refuses certificate API clients unless Api:PublicUrl is set.

Security headers

The app sends these headers on every response: X-Content-Type-Options: nosniff, X-Frame-Options: DENY (it cannot be embedded in another site), Referrer-Policy: no-referrer, a Permissions-Policy and a Content Security Policy.

IntensiveReportsConfig:Security:Csp	Effect
Enforce (default)	the full policy: scripts only from the site itself, no inline scripts
ReportOnly	browsers report violations but do not block. Use it only to test a change, for example a reverse proxy that injects scripts.
Off	only the basic policy (no framing, no plugins, no foreign base address)

Rate limit for the API

The report API, the MCP server and their sign-in addresses allow 120 requests a minute per client and 20 a minute per address without a valid token. Above that, they answer 429 with a Retry-After header; every refusal is written to the API audit log. The web pages themselves are not limited. Change the limits with IntensiveReportsConfig:Api:RequestsPerMinute and Api:AnonymousRequestsPerMinute.

Checklist for a production tenant

• RequireSignIn is true.
• ReaderRoles is set if not everybody in your organisation should see tenant-wide data.
• AllowedHosts names your host.
• The site is reachable over HTTPS only, and only from the networks that need it.
• Administrators hold IR.Admin; Global Administrators are administrators anyway.
• The report API is off, or each client has only the areas it needs (Report API and MCP).