Before you connect anything
We're asking a Global Admin for a read. Here's exactly what that means.
No writes, ever. No mailbox, file, chat or document access. Every scope we request is listed in plain language, with the Graph and Admin SDK permission next to it.
Directory, license assignment and sign-in activity. Nothing else. The app cannot write to your tenant.
offline_access · User.Read.All · Organization.Read.All · Directory.Read.All · AuditLog.Read.All
No email, no files, no chat, no documents, no calendar bodies. We read who exists, what they are licensed for, and when they last signed in.
US region, encrypted in transit (TLS 1.3) and at rest (AES-256). Metadata only — no tenant content is ever stored.
13 months of history so trend lines work. Delete on request, in full, within 7 days — self-serve from company settings.
Remove the enterprise application in Entra, or the OAuth grant in the Google Admin console. Access stops immediately.
SOC 2 Type II — in progress
Observation window opened March 2026, report expected Q4 2026. We are not going to claim a badge we do not have yet.