Assess your Microsoft cloud risk
Find out where your Azure and Microsoft 365 environment is exposed. Sign in with Microsoft and download your risk reports in about five minutes.
Free · No agents or installs · Read-only access you can remove
Available in English, Polski, Deutsch, Nederlands, Français, Italiano and Español.
Risks the assessment surfaces
The Cloud Security Report scores each Zero Trust pillar from your own Azure and Microsoft 365 telemetry. A pillar with no data is marked Not Assessed rather than given a score.
Identities
Privileged role assignments risk-scored per identity, plus Entra ID risk events such as impossible travel, anomalous sign-ins and legacy authentication.
Endpoints
Intune device compliance and Defender for Endpoint posture, including critical CVEs on devices that still pass compliance.
Data
External sharing across SharePoint and OneDrive, with shares to personal email addresses and anonymous links ranked by risk.
Applications
Third-party apps and shadow IT connected to your Microsoft tenant, with high-risk apps called out.
Network
Network Security Group rules across your Azure subscriptions that expose ports to the internet.
Security operations
Incidents raised by Microsoft Sentinel and Microsoft 365 Defender, and which Defender products are in place.
Licenses
Unused license seats and licensed accounts dormant for 30 days, wasted spend and stale access in one list.
AI
Azure AI resources with public network access, key-based authentication or missing content filters, and AI agents with no accountable sponsor.
See finished reports from a demo tenant in English, Nederlands, Deutsch or Polski before you run your own.
DOWNLOAD SAMPLE REPORTSResults without a project
Most security assessments are consultant-led engagements. TENET reads the same Microsoft signals directly, so you see your risk the same day.
| Typical assessment | TENET assessment | |
|---|---|---|
| Setup | A server or VM in your network, plus agents on endpoints | Sign in with Microsoft. No agents or installs |
| Who does the work | Consultants collect data and run interviews | An automated, read-only scan |
| Time to results | After the consultant has analysed and presented | Reports in about five minutes |
Four steps to your reports
- 1
Sign in with Microsoft
Use a Global Administrator account. To include Azure, the same account must own the subscriptions in scope.
- 2
Grant read-only consent
TENET creates an Entra ID app with read-only permissions. Your workloads are not changed.
- 3
Let the scan run
TENET analyses your Microsoft 365 and Azure environment, and you can follow each stage as it runs.
- 4
Download your reports
Pick your report language and download each report.
Read-only by design
TENET reads configuration, identity, exposure and health signals. It cannot create, change or delete anything in your tenant, and it never reads your content.
When you are done, delete the "TENET Risk Intelligence" app registration in the Microsoft Entra admin center and all of its access is gone. The last step of the assessment shows you how.
- File contents from SharePoint, OneDrive or storage accounts
- Email bodies, attachments or calendar content
- Secrets stored in your tenant
- Chat or Copilot conversation content
Reassess risk continuously
A one-off assessment is out of date as soon as your environment changes. The scan also creates a 14-day TENET trial on the same tenant connection, so your findings keep refreshing without running another assessment.
EXPLORE THE PLATFORMAlerts in Microsoft Teams
Security, compliance and operational alerts posted straight to a Teams channel.
Tracked remediation
Turn any finding into a remediation task with an owner, priority and status.
BriteAI on every finding
Ask why a finding matters and how to fix it, with its full details pre-loaded.
See your exposure today
Run the free assessment yourself, or book a demo and we will walk through your results with you.