Risks that build up quietly
Privileged access nobody reviews
Admin roles, service principals and guest accounts collect permissions over the years. One compromised identity with broad reach is enough to get to customer and transaction data.
Credential attacks in plain sight
Legacy authentication, impossible travel and password attacks hide in Entra sign-in logs that few teams have time to read line by line.
AI adoption ahead of control
Azure AI endpoints with weak authentication or missing content filters add a new exposure just as teams roll out Copilot and internal AI tools.
Know who can reach customer data
Years of role changes leave admins, pipelines and external accounts with more reach than their job needs. TENET inventories every identity, whether a person or automation, and shows how far its permissions extend.
- People, pipelines and external accounts in one list
- Permission reach shown for every identity
- Riskiest reach first, so reviews start in the right place
svc-payments-pipeline
Service principal · broad role across subscriptions
admin-treasury
Privileged role · rarely used
guest-auditor
Guest account · read access
svc-reporting
Service principal · scoped access
Sign-in from two countries
Gap too short to travel
Basic authentication attempt
Skips multifactor checks
Burst of failed sign-ins
One account, many attempts
Managed device sign-in
Known device and location
Surface suspicious sign-ins
TENET reads Entra sign-in and audit activity continuously and brings forward the events that point to a compromised account.
- Logins from places a user could not have reached in the time
- Sign-ins using older protocols that skip modern controls
- Bursts of failed attempts against one account
Break the attack chain
A flat list of findings hides how they connect. TENET maps each chain from an initial foothold to a high-value target, so you judge exposure by the route an attacker would take.
- Each hop from foothold to target shown in order
- Identity, resource and Microsoft 365 links in a single view
- Context for every finding, not an isolated line item
Exposed management port
Foothold · internet-facing VM
Managed identity with broad role
Pivot · reaches other subscriptions
Storage account with customer data
Target · reachable through the chain
FAQs
Does TENET change anything in our production workloads?
No. TENET reads configuration and security data through read-only permissions, so it cannot alter your production workloads or settings. It does not deploy agents.
See the Microsoft cloud integration guide for the exact roles and setup steps.
Is financial services in scope for NIS2?
Banks, insurers and investment firms in the EU fall under DORA, which takes precedence over NIS2’s risk-management and incident-reporting rules for them. TENET does not map findings to DORA today. It maps Azure and Microsoft 365 findings to NIS2 articles and NIST CSF 2.0 categories.
Read how TENET supports NIS2 compliance and NIST CSF 2.0.
Which environments does TENET cover?
Find your Microsoft cloud risk
Connect your Azure and Microsoft 365 tenant with read-only access and see which identities, exposures and anomalies matter most.