365 Tenants: what is captured and what is written
The areas of Entra ID, SharePoint, Exchange Online, Defender, Intune and Teams that 365 Tenants reads and rolls out, plus changes, Secure Score and comparison.
Areas
| Service | Settings | Read | Written |
|---|---|---|---|
| Entra ID | Conditional Access, named locations, authentication strengths and contexts | yes | yes |
| Entra ID | Security Defaults | yes | yes |
| Entra ID | Authentication methods and their settings | yes | yes |
| Entra ID | Lockout after failed attempts and banned passwords | yes | yes |
| Entra ID | User and guest permissions, app consent, consent requests | yes | yes |
| Entra ID | Cross-tenant access | yes | yes |
| Entra ID | Microsoft 365 groups | yes | yes |
| Entra ID | Devices in Entra | yes | yes |
| SharePoint and OneDrive | Sharing and sync | yes | yes |
| Exchange Online | Organization, “External” tag, audit log | yes | yes |
| Exchange Online | External forwarding and sending limits | yes | yes |
| Exchange Online | SMTP sending with a password | yes | yes |
| Exchange Online | Anti-phishing, spam, attachments, connection filter | yes | yes |
| Exchange Online | Outlook on the web | yes | yes |
| Defender for Office 365 | Safe Attachments for SharePoint, OneDrive and Teams | yes | yes |
| Intune | Compliance per platform | yes | yes |
| Intune | Settings catalog and endpoint security | yes | yes |
| Intune | Update rings for Windows | yes | yes |
| Intune | App protection for iOS and Android | yes | yes |
| Intune | Devices per user, allowed platforms, Windows Hello for Business, tenant settings | yes | no |
| Microsoft Teams | External access, storage and channels, meetings, messaging | yes | yes |
| Tenant | Licences and service plans | yes | no |
Microsoft does not let any app write the Intune settings that are only read. 365 Tenants shows and compares them; they are changed in Intune itself.
For Teams, the settings apply to the tenant's global policy and therefore to every user without a policy of their own.
Changes
Changes lists what changed between two snapshots, with the actor from the directory audit log as soon as Microsoft delivers it. The list can be searched, filtered and downloaded as CSV.
If a snapshot was incomplete, the areas marked “Not checked” keep the state of the last successful snapshot.
Microsoft recommendations
The overview shows the tenant's Secure Score and the open recommendations from Entra, each with its priority and the way to resolve it: through an entry in “Conbool gehärtet”, by hand in Entra, in on-premises Active Directory or only with Entra ID P2.
Comparing two tenants
Under Compare you place the stored state of two tenants side by side: differences, matches and what exists on one side only. This needs a second account with 365 Tenants and read permission in it. The comparison reads nothing from Microsoft.