Can the scan change anything in my tenant?

No. The scan only requests read permissions from Microsoft. They cannot change anything, even if you are a Global Administrator.

Which role do I need?

One of these roles in the tenant: Global Administrator, Global Reader, Security Administrator, Security Reader, or Privileged Role Administrator. The first time you connect, a Global Administrator consents to the read permissions for the whole tenant. After that, the Global Reader role is enough for every scan.

Does patchletter check my tenant between scans?

No. Every scan is started by someone in your organization, each time with a Microsoft sign-in. We do not store lasting access, and without that sign-in patchletter cannot read your tenant.

What is free, and what does Pro cost?

Free: one tenant and one scan within 7 days, with score, counts, history and, once you have confirmed your role in the tenant, the 3 most important open findings. patchletter Pro costs €49 net per month or €490 net per year, plus statutory VAT. With it you see all findings with affected objects, the PDF report, the license analysis and the framework mapping (guidance, not evidence), for up to 3 tenants and with notifications after a worse scan.

Does the report replace an audit?

No. It is a snapshot of the settings Microsoft Graph provides. The framework mapping is guidance, not evidence.

Microsoft's consent dialog says “tenantletter”. Is that right?

Yes. tenantletter is the name of the app the scan uses to make its requests to Microsoft; it belongs to patchletter. In the same dialog, Microsoft shows the read permissions you consent to.

Microsoft 365 · Tenant scan

Check the settings of your Microsoft 365 tenant

The tenant scan reads the settings of your tenant through Microsoft Graph and checks them with 53 checks, 32 of them from the CIS Microsoft 365 Foundations Benchmark 5.0.0. It only reads and changes nothing. You start every scan yourself.

Start for free What Pro adds

Read-only access through Microsoft Graph
You start every scan yourself
Free with a patchletter account

Result of a scan

Sample report

Score

68/100

Points out of 100, weighted by priority

Rating:Needs improvement

By state

Open: 14
Passed: 32
Check manually: 4
Not assessable: 3

The most important open findings

MFA required for administrative roles
CIS 5.2.2.1Priority: High
Why it matters: Privileged roles must be required to use MFA through a Conditional Access policy.
Legacy authentication blocked
CIS 5.2.2.3Priority: High
Why it matters: Legacy authentication protocols bypass MFA and must be blocked with Conditional Access.
User consent to apps is not allowed
CIS 5.1.5.1Priority: High
Why it matters: Users should not be able to grant permissions to applications on their own.

With Pro you see the remaining open findings.

Sample report: this is how patchletter shows you the result of a scan. Score and counts are sample values and do not come from a real tenant; the findings are real checks of the scan.

For free you see the score, the counts and, once you have confirmed your role, the 3 most important open findings; with Pro, all findings with affected objects.

What the scan checks

53 checks: 32 from the CIS Microsoft 365 Foundations Benchmark 5.0.0 and 21 more on identities, Conditional Access, devices and security signals. Every check comes with a rationale and a way to fix it.

Admin accounts and roles: How many global administrators there are, whether admin accounts are cloud-only and which privileged roles are assigned permanently instead of on demand.
MFA and sign-in methods: Whether all member accounts are MFA capable, which authentication methods are allowed and whether outdated sign-in protocols (legacy authentication) are blocked.
Conditional Access: Whether policies require MFA for admins and all accounts, respond to user and sign-in risk and block the device code flow, plus policies in report-only mode and named locations.
Guests and external sharing: Guest access to the directory, who may invite guests, stale guest accounts, access reviews and external sharing in SharePoint and OneDrive.
Apps and consent: Whether users may consent to apps or register apps, whether there is an admin consent workflow, which far-reaching permissions apps hold and how long app credentials stay valid.
Devices: Devices managed by Intune that fail their policies or have not synced for a long time.
Security signals: Secure Score, open incidents and alerts from Defender XDR, unresolved DLP alerts, risky accounts and sign-ins and the Microsoft 365 service health. What can be checked depends on the licenses and permissions in the tenant.
Licenses and usage With Pro: Which licenses the tenant has, how many of them are assigned and where licenses can be reclaimed or downgraded, with estimated savings. The estimate is based on list prices, not on your actual terms.

The CIS checks follow version 5.0.0 of the benchmark. The scan does not cover newer versions, with partly different numbers, yet.

What the scan does not check

The scan reads through Microsoft Graph only. It does not check settings that Microsoft only exposes through PowerShell. That mainly concerns Exchange Online, Microsoft Teams, Microsoft Purview and part of SharePoint Online.

Some checks cannot be assessed automatically; the report lists them as “Check manually”. If the tenant lacks a license or you lack a permission, individual checks stay “Not assessable”.

The report is a snapshot of the settings at the time of the scan. It does not say that nothing is missing beyond the checks.

How it works

Sign in to patchletter
You need a patchletter account. You sign in without a password, through a link sent to your email address.
Connect your tenant
You sign in at Microsoft with an account of the tenant. The first time, a Global Administrator consents to the read permissions for the whole tenant.
Start a scan
You start every scan yourself, each time with a short Microsoft sign-in. The scan runs on the patchletter server; the page shows you its progress.
Read the result
A score weighted by priority, counts by state and priority and, depending on your plan, the open findings with rationale and remediation.

Start for free, see everything with Pro

Free

Without Pro, with a patchletter account:

One tenant and one scan within 7 days
A score after every scan, with counts by state and priority
The 3 most important open findings with rationale and remediation, once you have confirmed your role in the tenant at Microsoft
A history that shows changes between scans

Start for free

With patchletter Pro

€49 net per month or €490 net per year, plus statutory VAT

patchletter Pro includes the tenant scan with the full report:

All findings with rationale, remediation and affected objects
Mapping to BSI C5, BSI IT-Grundschutz, NIS2, ISO 27001, NIST CSF and CIS (guidance, not evidence)
A license analysis with unused licenses and estimated savings
The full report as a PDF
Notifications by email or webhook when a scan comes out worse than the previous one
Up to 3 tenants, no weekly quota; at most 10 scan starts per tenant and day

Everything else Pro includes is on the pricing page.

Book Pro

Your results next to well-known frameworks

With Pro, the report maps the results to requirements of these frameworks. You see which of the listed requirements your tenant has open findings for. Only requirements for which the scan checks settings in your tenant are listed.

BSI C5:2020 (Cloud Computing Compliance Criteria Catalogue)
BSI IT-Grundschutz Compendium, Edition 2023
NIS2 Directive (EU) 2022/2555, Art. 21(2)
ISO/IEC 27001:2022, Annex A
NIST Cybersecurity Framework 2.0
CIS Microsoft 365 Foundations Benchmark v5.0.0, Level 1 (subset)
CIS Microsoft 365 Foundations Benchmark v5.0.0, Level 2 (subset)

Guidance, not evidence: the mapping does not replace an audit, an attestation or a certification. The scan does not check organisational measures. If a listed requirement includes settings that can only be read via PowerShell, they are marked “Not in the scan” there.

Notifications after a scan

With Pro, owners and admins of your organization get an email when a complete scan comes out worse than the previous one of the same tenant: when the score drops by at least 5 points or a new high-priority finding appears. The drop must also hold for the checks rated in both scans: if the score only drops because checks were skipped, for example due to missing permissions or licenses, no notification is sent. If you like, the notification also goes to a webhook target, for example in Slack. The notification contains numbers and a link, but no findings, no accounts and no tenant name.

Notifications are only sent after a scan someone in your organization started. patchletter does not check your tenant between scans.

Webhook format in the API docs

What the scan may do

Read-only: the scan requests 17 delegated read permissions of Microsoft Graph. Microsoft shows them to you before you consent.

See all permissions

User.Read.All: Read user accounts, such as administrators and guests
Directory.Read.All: Read the directory: groups, roles and settings
Policy.Read.All: Read policies, such as Conditional Access and authentication methods
RoleManagement.Read.Directory: Read role assignments and Privileged Identity Management
AuditLog.Read.All: Read sign-in and registration data, for example for MFA coverage
Reports.Read.All: Read usage and registration reports
Organization.Read.All: Read the tenant's name and basic data
AccessReview.Read.All: Read access reviews
SharePointTenantSettings.Read.All: Read the tenant's SharePoint settings
OrgSettings-Forms.Read.All: Read Microsoft Forms settings
IdentityRiskyUser.Read.All: Read risky users (Entra ID P2)
IdentityRiskEvent.Read.All: Read risk detections (Entra ID P2)
SecurityEvents.Read.All: Read Microsoft Secure Score
SecurityAlert.Read.All: Read Defender XDR alerts, including DLP
SecurityIncident.Read.All: Read Defender XDR incidents
DeviceManagementManagedDevices.Read.All: Read devices managed by Intune
ServiceHealth.Read.All: Read Microsoft 365 service health

The scan does not read the content of emails, files or chats.

We do not store the access token; we discard it after the scan. For the next scan you sign in at Microsoft again.

You can connect and scan with one of these roles in the tenant:

Global Administrator
Global Reader
Security Administrator
Security Reader
Privileged Role Administrator

The scan rejects guest accounts.

Owners and admins of your patchletter organization see the report. patchletter only shows findings to people who have confirmed at Microsoft within the last 30 days that they hold one of these roles in the tenant.

Frequently asked questions

Can the scan change anything in my tenant?: No. The scan only requests read permissions from Microsoft. They cannot change anything, even if you are a Global Administrator.
Which role do I need?: One of these roles in the tenant: Global Administrator, Global Reader, Security Administrator, Security Reader, or Privileged Role Administrator. The first time you connect, a Global Administrator consents to the read permissions for the whole tenant. After that, the Global Reader role is enough for every scan.
Does patchletter check my tenant between scans?: No. Every scan is started by someone in your organization, each time with a Microsoft sign-in. We do not store lasting access, and without that sign-in patchletter cannot read your tenant.
What is free, and what does Pro cost?: Free: one tenant and one scan within 7 days, with score, counts, history and, once you have confirmed your role in the tenant, the 3 most important open findings. patchletter Pro costs €49 net per month or €490 net per year, plus statutory VAT. With it you see all findings with affected objects, the PDF report, the license analysis and the framework mapping (guidance, not evidence), for up to 3 tenants and with notifications after a worse scan.
Does the report replace an audit?: No. It is a snapshot of the settings Microsoft Graph provides. The framework mapping is guidance, not evidence.
Microsoft's consent dialog says “tenantletter”. Is that right?: Yes. tenantletter is the name of the app the scan uses to make its requests to Microsoft; it belongs to patchletter. In the same dialog, Microsoft shows the read permissions you consent to.

Start with a free scan

Start for free