Skip to content
IntensiveReports IntensiveReports

API and MCP

Everything you can see in a report you can also read without the browser. IntensiveReports has a report API for scripts and other tools, and an MCP server that lets an AI assistant answer questions about your tenant from the same reports.

What you can do with it

Section titled “What you can do with it”
  • Feed other tools. Pull findings into your ticketing system, your SIEM or a Power BI report on a schedule, for example “every Monday, open a ticket for each expired app secret”.
  • Automate reviews. A PowerShell or Python script reads the guest, licence or admin reports and writes the evidence for a quarterly access review.
  • Ask questions in plain language. Connect an AI assistant, and ask “Which administrators lack phishing-resistant MFA?” or “Summarise the open findings for Exchange Online”. The assistant finds the right report, reads it and answers with the numbers.

The API and the MCP server return what the report pages show: the same rows, key numbers, charts and notes, from the same cached data. Every report is available, all 319 of them.

Safe by default

Section titled “Safe by default”
  • Off until an administrator switches it on. While it is off, every API and MCP address answers “not found”.
  • One client per tool or person. An administrator creates a client for each script, tool or assistant, under Settings > API access. Each client has its own credentials and can be removed at any time.
  • Rights per product area. For each area (Entra ID, Security, Intune, Exchange Online, SharePoint Online, OneDrive, Teams, Licensing, Compliance, Tenant) a client gets Read, Refresh or Run scan, or nothing. A client sees only the reports of the areas it may read. Presets make this quick: Reader reads everything, Operator reads and refreshes everything, AI assistant reads only the areas you tick.
  • Reports a client never sees. Single reports can be hidden from a client, for example everything that lists personal data.
  • Expiry. A client can expire after a set number of days.
  • Strong sign-in. A client signs in with a generated token, with its own certificate, or with an Entra ID token, so you can keep secrets out of scripts entirely.
  • Every call is logged. The audit log records each call with the client and the report, and is kept for 90 days.
  • Rate limits. Each client may make 120 requests a minute, so a runaway script cannot slow down the app.

Next steps

Section titled “Next steps”