Security and privacy
IntensiveReports runs on your own server and reads your own tenant. You decide who can open it, which permissions it holds and whether anything leaves the server.
Access to your tenant
Section titled “Access to your tenant”- It reads; it does not change. IntensiveReports never creates, changes or deletes anything in your tenant.
- Its own identity. The app signs in as its own Entra ID app registration, with a certificate. It uses application permissions that an administrator grants once with admin consent. The setup scripts grant the read-only permissions and the Global Reader role. See Entra app registration.
- Where Microsoft has no read-only permission. A few Microsoft interfaces offer only broader permissions:
SharePoint’s tenant administration cmdlets need
Sites.FullControl.All, Exchange Online PowerShell needsExchange.ManageAsApp, and the optional App Proxy, Windows Update and Microsoft 365 Backup reports need aReadWritepermission. The app still only reads, but the grant allows more. Every permission and the reports that need it are listed in the permission reference, so you can leave out what you do not use. - Each report says what it needs. The ? button on every report lists the licence, the permissions and the Microsoft endpoints the report reads.
What is stored, and where
Section titled “What is stored, and where”| What | Where | Kept |
|---|---|---|
| Tenant data (users, devices, mailboxes, report results) | the server’s memory only | until the next refresh or a restart |
| Daily headline numbers for the trend lines (counts, no names) | a file on the server | 400 days |
| Settings for everyone (thresholds, cache, default layouts) | a file on the server | until changed; the previous version is kept for undo |
| Licence prices you enter for the chargeback report | a file on the server | until changed |
| API clients (only a hash of each token is stored) | a file on the server | until removed |
| API audit log (one line per API or MCP call) | files on the server | 90 days |
| Your own preferences (layout, formats, favourites) | a cookie in your browser | 400 days |
| Error and activity logs | the server’s log folder | as configured by your administrator |
Tenant data is not written to a database or to disk. A restart of the app clears it, and it loads again in the background.
What leaves the server
Section titled “What leaves the server”- Calls to Microsoft. The app talks to Microsoft Graph, Exchange Online, SharePoint Online, Teams, Defender, Azure Resource Manager and Power Platform, all of them Microsoft cloud services of your tenant.
- DNS and your own domains. The mail authentication reports look up DNS records (SPF, DMARC, MX, MTA-STS) through the server’s DNS, and read the MTA-STS policy file from your own domains.
- Nothing else. IntensiveReports sends no usage data or telemetry to the vendor or to anyone else.
- An AI assistant, only if you connect one. If an administrator gives an AI assistant access through the MCP server, the data the assistant reads goes to that assistant’s provider.
Who can open it
Section titled “Who can open it”- Sign-in with Entra ID. Users sign in with their Microsoft work account (Log in at the top right).
- Required sign-in. Your administrator can require every user to sign in, and to hold one of a list of app roles, before anything is shown. Only accounts of your own tenant can then open the app. See Sign-in and access.
- Administrators. Settings that apply to everyone, dashboard defaults and API clients can only be changed by a Global Administrator or a user with the app role IR.Admin, both signed in from your tenant.
- Error details. Full error texts are shown only to users signed in from your tenant. Everyone else sees a short reference code that your administrator can look up in the log.
The report API and MCP server
Section titled “The report API and MCP server”The API and MCP server are off until an administrator switches them on. Each client has its own credentials, rights per product area, an optional expiry and a rate limit, and every call is logged. See API and MCP.
Built-in web protection
Section titled “Built-in web protection”- Strict browser security headers: no framing by other sites, no content sniffing, no referrer sent to other sites, and a content security policy that allows scripts only from the app itself.
- HTTPS with HSTS.
- Links built from tenant data only open
http,httpsor in-app addresses, and links to other sites open without access to the app’s window. - CSV exports cannot start a spreadsheet formula, and exports can pseudonymise personal data.