Microsoft 365 Posture Scanner
Sign in with Microsoft and get a graded security review of the tenant in about a minute: MFA coverage, admin roles, Conditional Access, legacy authentication, risky app consents, guests, stale accounts, licences and email domain security, each with the exact fix.
● Read-only. Data goes from Microsoft straight to this browser tab; OpsVantage never sees it.Scan a tenant
Sign in as a Global Reader (recommended) or Global Administrator of the tenant you want to review. The first scan of a tenant needs one-time admin consent.
Live sign-in is being set up. Meanwhile, the demo tenant shows the full report.
What the scanner can read
Delegated, read-only Microsoft Graph permissions. It cannot change anything, and it only sees what your own account can see.
| Directory.Read.All | Users, guests, groups, admin roles, app consents |
| Policy.Read.All | Conditional Access, security defaults, consent and guest settings |
| AuditLog.Read.All | Last sign-in dates and the MFA registration report |
| UserAuthenticationMethod.Read.All | MFA methods when the report needs a licence you lack |
| SecurityEvents.Read.All | Microsoft Secure Score |
| IdentityRiskyUser.Read.All | Users flagged at risk (Entra ID P2) |
No refresh token is requested and nothing is stored: close the tab and the session is gone.
Scanning
Built for MSP reviews
Client-ready report
Put your MSP name on it, save as PDF and send it. Every finding has evidence and a step-by-step fix.
Works on every licence
Business Basic to E5. Checks that need Entra ID P1 or P2 are marked "not checked" instead of guessed.
Private by design
No backend, no database, no third-party scripts. The browser talks to Microsoft Graph directly with a short-lived token. How data is handled.