See what Copilot can reach in your tenant

What you get back

• Every external share, listed and scored — anonymous links, links that allow editing, guests who have not signed in for months, and the resources each can reach.
• The internal over-exposure — organisation-wide links and company-wide groups such as "Everyone except external users". These are the patterns that make Copilot surface far more than anyone intended, and they are invisible in native reports.
• Risky grants beyond files — over-permissioned OAuth applications, and mail forwarding to domains nobody in your organisation owns.
• A remediation order — not a CSV of everything, but what to revoke first, ranked by sensitivity and blast radius, with the ones that are safe to automate marked.

What it costs, and what it does not

Nothing. No card, no trial that converts into a subscription, no contract. If the report tells you your estate is in good shape, that is a perfectly good outcome and we will say so.

The catch, stated plainly: we do this because a scored list of your own exposure is a better argument for the product than any page on this site. If it is not compelling, you will not buy, and that is fair.

What it touches

• Read-only, app-only. Application permissions through Microsoft Graph — not a user's session, no agent to install, no disruption to anybody working.
• Metadata, not content. We read who can reach what. We do not read your documents or your mail.
• Nothing is changed. Remediation needs a separate consent that this assessment does not ask for and does not use.
• You can revoke it the moment the report lands, and the findings you have been given remain yours.

How it runs

1. You tell us the tenant and roughly how big it is.
2. We agree the scope and a date before anything connects.
3. An administrator grants read-only consent to the Entra application for the product being assessed — scoped to that product, and nothing else.
4. The crawl runs. Large estates are swept in stages so nothing is throttled.
5. You get the report, and a walkthrough of it if you want one.

Managing many tenants?

The provider version ranks your worst clients against each other, so the conversation you have with them is specific rather than general. More on the provider model.

Ask for the report

Tell us the tenant size and we will come back with a scope and a date. A person replies, usually the same working day.

Name

Work email

So we can reply. Nothing else is done with it.

Organisation

Tenant size

Anything we should know?

Request my exposure report

Or email jeff@jeffops.com directly.