Trust centre
Data protection
Last updated 5 November 2026
Who is responsible for what
When you use ConfigCheckup to assess a Microsoft 365 tenant, the data read from that tenant is processed on your instructions. You (or your tenant, where you are an MSP acting for them) are the controller, and ConfigCheckup Ltd acts as your processor under our data processing agreement. Where you are an MSP, we are a sub-processor to you.
For the accounts of people who sign in to ConfigCheckup, and for billing, ConfigCheckup Ltd is the controller. That is covered by the privacy notice.
How ConfigCheckup connects
ConfigCheckup authenticates as its own multi-tenant Microsoft Entra application with application permissions, granted by an administrator of the tenant through Microsoft's admin consent screen. No password or credential of yours is given to ConfigCheckup. A tenant's own app registration, saved before ConfigCheckup stopped taking new ones, has its secret encrypted with AES-256-GCM, bound to that tenant's record, so it cannot be decrypted in the context of any other tenant.
Read permissions (assessment)
| Permission | Why it is needed | Required |
|---|---|---|
Organization. | Tenant profile, verified domains, technical contacts and assigned plans. | Yes |
Directory. | Users, groups, devices and directory objects that underpin most checks. | Yes |
User. | Account state, licence assignment (and which licences a group gives), whether a guest accepted their invitation, and sign-in activity per user. | Yes |
Group. | Microsoft 365 groups, ownership, membership and guest exposure. | Yes |
Group | Resolves the membership of groups targeted by Conditional Access. | Yes |
Policy. | Conditional Access policies, authorization policy, security defaults, auth methods policy, idle session timeout and app credential restrictions. | Yes |
Role | Directory role assignments, PIM eligibility and PIM role settings (approval and alerts) — the privileged access picture. | Yes |
Application. | App registrations, service principals, credential expiry and delegated consent grants, and whether Microsoft has verified the publisher of an app someone consents to. | Yes |
Audit | Last sign-in timestamps (dormant account detection), directory audit retention, and the audit and sign-in logs read for security event alerts. | Yes |
Reports. | Authentication method registration, service usage, mailbox and OneDrive sizes and Microsoft 365 Copilot usage reports. Mailbox and OneDrive sizes are read with the users: without this permission the users are still read, without their sizes. | Yes |
Security | Microsoft Secure Score and its control profiles. | Yes |
SecurityOptional | Microsoft Defender security alerts: to flag alerts left unresolved, and to raise new medium and high alerts as security events, with their title, category and the names of the accounts, devices and apps involved. Never mail or file content. | Optional |
Files.Optional | Which files and folders in people’s OneDrives and Microsoft 365 groups’ libraries anyone can open with a link, without signing in: each one’s name, address and library. Never file content. | Optional |
IdentityOptional | Identity Protection risky users and risk detections. | Optional |
DeviceOptional | Intune compliance and configuration policies, and whether a device with no compliance policy counts as compliant. | Optional |
DeviceOptional | Intune enrolment restrictions: whether personally owned devices can enrol. Settings only; no device is read. | Optional |
DeviceOptional | Enrolled device inventory, compliance state and OS versions. | Optional |
DeviceOptional | Which Windows devices back up their local administrator password (Windows LAPS). Device names only; passwords are never read. | Optional |
MailboxOptional | Inbox rules, to find mail being forwarded outside the organisation, and, read live on a person’s panel and never stored, whether their automatic reply is on and when. Rule definitions and reply status only; no message content. | Optional |
ShareOptional | Tenant-wide SharePoint and OneDrive sharing configuration. | Optional |
DirectoryOptional | Microsoft Entra recommendations, including Identity Secure Score, and the objects each one names. | Optional |
ServiceOptional | Microsoft 365 message centre posts, to flag changes with an "act by" date. | Optional |
ServiceOptional | Microsoft 365 service health: open incidents and advisories. | Optional |
Policy.Optional | Entra ID device settings: who may join devices, the device limit per person, local administrators on joined devices and Windows LAPS. | Optional |
AccessOptional | Access review definitions: whether guests and privileged roles are reviewed, how often and with what settings. Review decisions are not read. | Optional |
Policy.Optional | The list of domains guests may, or may not, be invited from. | Optional |
OrgOptional | Whether people can use the Office Store and start trials of apps and services themselves. | Optional |
OrgOptional | Microsoft Forms settings: whether phishing protection checks forms made in the organisation. Forms and responses are not read. | Optional |
SecurityOptional | Microsoft Defender for Endpoint security recommendations (WindowsDefenderATP API). Recommendation names and device counts only. | Optional |
Without an optional permission, the related checks are reported as not assessed and excluded from the score; they are never reported as passing. Email authentication checks (SPF, DKIM, DMARC, MTA-STS) need no permission: they read the public DNS records of your custom domains. Nor do domain renewal dates: they are read once a day from each domain's registry through its public RDAP service, found from IANA's list, which are sent the domain's name only.
Read-only roles (optional)
Some settings have no Microsoft Graph permission: Microsoft lets an application read them only once it holds a read-only directory role. Your administrator assigns the role to the read-only app in Entra (Roles and administrators), or signs in to Microsoft from ConfigCheckup so that it makes the assignment as them, recorded in Entra's audit log under their name; ConfigCheckup never assigns a role to itself. Without it, the related checks are reported as not assessed.
| Role | Why it is needed |
|---|---|
Teams Reader (or Global Reader) | Microsoft Teams meeting, external access, messaging and app policies, which have no Microsoft Graph API. Policy settings only; no chats, calls or meetings are read. |
Write permissions (automation only)
These belong to a second application, ConfigCheckup Automation. Your administrator approves it with its own consent, and it appears as its own entry under Enterprise applications: deleting it removes every write permission at once while assessments carry on through the read-only app. Even after they are granted, nothing can change in a tenant until automation is switched on for that specific tenant, someone with the role has asked for the change, and a dry run has succeeded. Anything that removes or disables is approved by one or two people, your choice per tenant; some higher-risk changes always need two. With two, at least one is not the person who raised it. Changes that only add, and taking one person out of a group or a mailbox, run without approval and can be undone.
The same app is how Exchange Online settings are read: Microsoft lets an application read them only with Exchange.ManageAsApp and an Exchange admin role, so the 32 Exchange Online checks run through this app, with the Exchange Administrator role the tenant gives. Without it, those checks are reported as not assessed.
| Permission | Used for |
|---|---|
Device. | Disable or delete inactive end-of-life devices in Entra ID through an approved action. |
Device | Delete the Intune records of inactive end-of-life devices through an approved action. |
Policy. | Create or amend Conditional Access policies via an approved action. |
User. | Create users, give licences and invite guests when someone asks; disable dormant accounts, revoke sessions, clear licences, delete blocked accounts and remove guests (restorable for 30 days), and create cloud-only admin and emergency access accounts through an approved change. |
User-Password | Reset a user’s password to a one-time password they must change at next sign-in, through an approved change, or give a new person’s account a temporary password where Temporary Access Pass is off. The password is shown once and never stored. |
Role | Remove stale or redundant privileged role assignments via an approved action. |
Policy. | Tighten tenant user settings (app consent, app registration, guest invitations) via an approved action. |
Share | Change SharePoint and OneDrive sharing settings (Anyone link expiry, guest-only sharing, resharing, sharing only with approved domains) via an approved action. |
Directory. | Remove redundant role assignments and stale directory objects. |
Mailbox | Turn off inbox rules that forward mail outside the organisation, and set or turn off someone’s automatic reply, via an approved action. The reply already set, its message included, is read and kept with the change so a rollback can put it back; no email is read. |
Device | Create the Intune device baseline (compliance, encryption, firewall, antivirus and update policies) through an approved change. |
User | Remove MFA methods in an approved change: a leaver’s in an offboarding, a compromised account’s in a containment, or a person’s who lost their phone (Reset MFA); and issue a one-time Temporary Access Pass (shown once, never stored) for an account an approved change created, or, inside the approved run of an MFA reset, for the person whose methods it removed: shown once to the approver who runs it, never when the person who asked for the reset runs it, and never for an account holding an admin role or an emergency access account. |
Group | Add people to groups and Teams, or set up a new starter in the same groups as a colleague, when someone asks; remove people from groups, or a leaver from all of theirs, through an approved change. |
Files. | Give a leaver’s manager access to their OneDrive as part of an approved offboarding, and remove sharing links anyone can open from the files someone chooses, through an approved change. File contents are not read. |
Application. | Block risky or unused apps from signing in ("Enabled for users to sign in"), and remove app secrets that have already expired, via an approved action. |
Delegated | Revoke delegated consent that gives an app access to mail, files or the directory, through an approved change. |
Group. | Create groups and Teams and add their owners when someone asks; take an owner off, make public groups and Teams private, and delete unused groups, through an approved change. Group content is not read. |
Organization. | Fill in the tenant’s technical and security notification contacts through an approved change. |
Policy. | Turn on the Microsoft Authenticator registration campaign, turn off text message, voice and email codes, and show sign-in context in Authenticator, each through an approved change. |
Policy. | Turn on the admin consent workflow, so people can ask for an app they may not approve themselves, through an approved change. |
Policy. | Tighten the default cross-tenant access settings (Teams shared channels, partner MFA trust) through an approved change. |
Device | Ask Intune devices to check in now, and lock, wipe, retire, rename or restart a chosen device, each through an approved change. A full wipe always needs two approvers in the console. |
Security | Resolve the Microsoft Defender alerts someone has chosen, with their classification, through an approved change. |
Domain. | Make a verified custom domain the default, or add and verify one, through an approved change. |
Exchange. (Office 365 Exchange Online) | Read and change Exchange Online and Defender for Office 365 settings with Exchange's admin commands, and Purview's where Purview automation is on. It works only together with the role below. |
Roles for the automation app
Your administrator gives these roles to ConfigCheckup Automation in Entra (Roles and administrators), or signs in to Microsoft from ConfigCheckup so that it makes the assignments as them, recorded in Entra's audit log under their name; the permission that sign-in allowed is taken off the app straight away. ConfigCheckup never gives itself a role.
| Role | Why it is needed |
|---|---|
Exchange Administrator | Reading Exchange Online and Defender for Office 365 settings (the 32 Exchange Online checks), and the Exchange Online and Defender for Office 365 changes you approve. |
Compliance Administrator | Purview changes you approve. Given only where Purview automation is switched on for the tenant, which it is not by default. |
Your Partner Center (optional)
If you are a Microsoft CSP partner and connect Partner Center, a partner admin signs in once with Microsoft (Partner Center requires MFA for this). Partner Center accepts only signed-in access for subscription changes, so ConfigCheckup keeps that sign-in's refresh token, encrypted with AES-256-GCM and bound to your workspace's connection. It is limited to the Partner Center API, replaced each time it is used, and deleted when you disconnect; revoking the account's sessions in Microsoft Entra also ends it. ConfigCheckup uses it to read your tenants' CSP subscriptions (product, seat count, term and renewal date, which are not personal data) and to change a seat count only after the change has been dry-run and approved like any other.
What is read and kept
Each assessment keeps a trimmed snapshot of the data the checks need, and the results of those checks:
- People: user principal name, display name, account state, user type, for guests whether and when they accepted their invitation, licences assigned, last sign-in dates, MFA and authentication-method registration, department and job title where set.
- Configuration: Conditional Access and authorisation policies, directory role assignments, app registrations and consent grants, group settings and ownership, SharePoint sharing settings; Entra ID device, password protection, Privileged Identity Management and access review settings (the review settings, never the decisions); Exchange Online and Defender for Office 365 protection policies and mail flow rules, with the addresses, domains and mailboxes they name; Teams meeting, external access and app policies; Intune compliance and enrolment settings; and, where Purview is set up, the names and settings of DLP, sensitivity label, alert and retention policies and of retention labels (alert recipients are counted, not kept, and nothing a policy or label covers is read).
- Devices: device name, manufacturer, model, serial number, operating system and version, compliance and encryption state, enrolment and last sync dates.
- Security signals: Secure Score, alert counts by severity, risky users and risk levels; and, for security event alerts, the directory audit and sign-in records behind each alert (account, time, IP address, approximate location, app and result). The sign-in log itself is read and discarded: only the records behind an alert are kept, with the countries the tenant usually signs in from.
- Conditional Access results: for a policy you check, a summary of a week of the sign-ins it applied to, and the accounts it blocked or asked for MFA.
- Usage: licence and Microsoft 365 Copilot usage from Microsoft's usage reports: who used Copilot, in which apps and when, and each account's last activity. Never prompts or answers.
- Email: public DNS records for your custom domains, and, with the optional permission, the name and external recipients of inbox rules that forward mail outside the organisation. Where Exchange is set up, where a mailbox forwards its mail, and whether it is hidden from the address book, has an archive or is on litigation hold.
- Results: findings with their evidence, reports you generate, notes your team adds, and an audit log of actions taken in ConfigCheckup.
Read live and not kept: when someone opens a person on People, ConfigCheckup reads their manager, business and mobile phone numbers, email addresses and aliases, and the groups they are in directly, from Microsoft, and, with the optional permission, whether their automatic reply is on and between which dates, never its message. When a Technician or above asks for them, it also reads the person's last few typed sign-ins of the past 30 days: when, the app, the town and country, the browser and system, and the result, never the IP address. They are shown on the page, held in memory for at most a minute, and never stored. Each look at someone's sign-ins is recorded in the audit log.
An automatic reply a change replaces: when an approved change sets, changes or turns off someone's automatic reply, on its own or in an offboarding, ConfigCheckup reads the reply they had, its message included, and keeps it with the change so a rollback can put it back exactly. Its first 80 characters are shown on the change. No email is read.
Never read: email bodies or attachments, files and documents, Teams messages, calendar entries, passwords or authentication secrets. The read-only app has no permission that could. The automation app holds one file permission (Files.ReadWrite.All), which lets an approved offboarding give a leaver's manager access to their OneDrive, and the Exchange Administrator role for Exchange Online settings; ConfigCheckup never uses either to open content, and every change it makes is logged.
When an approved change creates an account (a cloud-only admin account or an emergency access account), it is given a long random password that is sent to Microsoft and never kept or shown. Its first sign-in uses a Temporary Access Pass that an admin asks for on the change's page: it is shown to them once, never stored, and only the fact it was issued is logged. After an approved MFA reset, one of its approvers can issue such a pass the same way.
An approved password reset works the same way. ConfigCheckup makes a one-time password, sends it to Microsoft with “change it at next sign-in”, and shows it once to the approver who runs the reset, in the console. It is never stored, emailed or logged, even encrypted; the audit log records who asked, who approved, the account and the time.
No AI processing
No artificial intelligence or large language model reads, stores or processes your tenants' data, and none is sent to an AI provider. Assessments are rules written by people that compare configuration with a stated standard; automated fixes are pre-written Microsoft Graph, Exchange Online and Purview changes and DNS records, applied only after a person approves them; reports are built from the assessment results with fixed templates and rendered to PDF on ConfigCheckup's own servers. The Copilot pages report on a tenant's own Microsoft 365 Copilot licences and usage; they do not use AI themselves.
Where data is stored
The ConfigCheckup service, its database and generated reports are hosted in the EU (Frankfurt) by Render. Data from Microsoft 365 is read from Microsoft's service endpoints for the tenant's cloud and written only to that database.
How it is protected
- Every workspace is isolated: records are fetched only through accessors that refuse rows belonging to another organisation.
- Connections to ConfigCheckup use HTTPS. Session cookies are HTTP-only, secure and same-site.
- Passwords are stored as salted scrypt hashes. Session tokens, share links and invitation links are stored only as hashes.
- Stored tenant credentials, integration secrets and the Partner Center sign-in are encrypted with AES-256-GCM.
- Logs redact secrets, passwords, tokens, cookies and keys before they are written.
- Report downloads are private and scoped to your workspace; share links expire and are not indexed.
- An append-only audit log records consents, assessments, report downloads and exports, finding updates, approvals and every change made to a tenant.
Signing in to ConfigCheckup: with Microsoft, so your own Conditional Access and MFA apply, or with a password of at least 12 characters plus optional two-step verification from an authenticator app, which a workspace owner can make mandatory. Sign-in attempts are rate limited, and every sign-in, failed attempt and security change is recorded in the audit log.
Retention and deletion
- Assessment snapshots, findings and reports are kept for your plan's history period (shown under Settings), then deleted automatically each night. The latest two assessments for each tenant are always kept, so the current picture and change tracking still work for tenants assessed rarely.
- Within that period, older history is kept weekly then monthly: every assessment for 90 days, then one a week up to a year, then one a month. The others keep their score and summary; their collected data and most of their findings are deleted.
- Audit log entries are kept while your workspace exists, because they are the record of who did what.
- Removing a tenant from ConfigCheckup deletes its assessments, snapshots, findings and reports.
- An Owner can close the workspace and delete all of its data in Settings → Workspace, or ask us at support@configcheckup.com.
Revoking access
A tenant administrator can remove ConfigCheckup's access at any time in the Entra admin centre: Identity → Applications → Enterprise applications → select the ConfigCheckup application → Delete, and the same for ConfigCheckup Automation if the tenant added it. Access stops immediately; the next assessment will fail and report that consent is missing.
Sub-processors
| Provider | Purpose | Data involved |
|---|---|---|
| Render | Application and database hosting | All data described on this page |
| Resend | Sending notification and invitation emails | Recipient email addresses, tenant names and summary results |
| Stripe | Subscription billing | Billing contact and payment details (no tenant data) |
Incidents
If we become aware of a personal data breach affecting your data, we will notify you without undue delay, with the information you need to meet your own obligations.
Contact
Data protection questions and data processing agreements: support@configcheckup.com. Security issues: support@configcheckup.com. ConfigCheckup Ltd is registered with the Information Commissioner's Office under registration number ZC281968.
ConfigCheckup
Read-only, and yours to revoke. Try it on a tenant.
14 days of daily monitoring and alerts, every finding with its fix guide, and reports on up to 3 tenants, from your first connected tenant. No card. Then choose the plan that fits.