Microsoft 365 visibility
Sites, guests, apps, devices: why does nobody have one count?
Sites, guests, apps and devices are counted in different places, by different people, at different times - so nobody has one number. Most tenants hold several times more sites than IT believes, hundreds of guests who were invited straight into sites, and dozens of consented apps nobody remembers approving. 1Security connects read-only and counts all of it - live, in one place, with what each thing can reach.
The problem
The official inventory is the optimistic one.
The site count most teams carry in their heads covers the sites somebody deliberately created. It rarely includes the private-channel and shared-channel sites every Team spins up on its own, or the personal OneDrive behind every user - each a real store of company data with its own permissions and its own sharing links. In a typical tenant the real site count is three to five times the number IT would quote.
The same goes for people and things. A directory-based guest list covers directory guests; SharePoint-only guests - external people invited straight to a site - need to be counted from the sites themselves. Devices that read your files without ever enrolling only show up in activity. And the 30-50 consented apps and AI agents that hold a standing credential into your data are rarely on any inventory at all.
Every audit, every Copilot rollout and every incident starts with the same question: what do we actually have? Counting it by hand, source by source, is a quarter of work - and it is stale the week it is finished.
In practice
From one read-only consent to a counted tenant.
What discovery looks like on a real tenant - no agent, no scripts, no spreadsheet.
- 01
Connect read-only and let the scan run
One consent, standard Microsoft licenses, no agent to install. A tenant under 100,000 files is mapped in an hour or two; the largest tenants run past 40 million files and resume on their own if interrupted. New resources show up within about ten minutes at any size, so the lists are useful long before the deep scan finishes.
- 02
Watch eight inventories fill in
Sites (including channel sites and every personal OneDrive), Files, Users (including SharePoint-only guests), Groups (all six types kept distinct), Apps, Agents, Devices and Emails - each a live list you can filter, sort and export. The first surprise is usually the site count; the second is the guest count.
- 03
See what you did not know was there
Apps arrive with their consent channel and the first admin who let them in. Devices arrive classified as registered, unregistered or shadow - a shadow device is one seen reading data with no authentication observed at all. Sites arrive with their external users, storage in GB and last activity attached, so "we have 2,400 sites" comes with "and 310 of them are external-facing".
- 04
Keep it counted
The inventory stays live: a new Team, a new guest, a new app consent appears in about ten minutes. The number you quote in the steering meeting is the number as of this morning, not the export someone ran last quarter.
What makes it work
Not a list of names. A graph of what reaches what.
Every row in the inventory is connected to what it can access and what has touched it, so a count is one click away from a list.
The living inventory
Eight live inventories on one permission graph, with orphaned indicators on every one of them: no owners, no activity in a year, dormant with access still intact.
Explore the inventory tool →Sites ranked by exposure
Every site with its members, sharing links, external users, sensitive findings, storage and Copilot flag - ranked by what actually matters, not alphabetically.
Explore SharePoint governance →Devices the directory missed
Registered, unregistered and shadow devices reconstructed from real activity - including machines that read your files without ever authenticating the normal way.
Explore device detection →
FAQ
Common questions.
How long until we see the first numbers?
Minutes for the first lists, hours for a full map of a mid-size tenant. A tenant under 100,000 files is fully mapped in one to two hours, a million files in six to twelve, and the largest tenants run for weeks - resuming automatically if interrupted. New resources appear within about ten minutes regardless of size.
What will it find that our own inventory does not have?
Typically: private and shared channel sites, SharePoint-only guests, devices that read data without ever enrolling, and consented apps and AI agents nobody inventories. In most tenants the real site count is several times the one IT quotes and the guest count is higher than the directory-based list.
Does discovery change anything in the tenant?
No. Discovery runs on a read-only consent. Write actions exist in 1Security, but they live in separately consented modules and never run without that explicit opt-in.
What licenses do we need?
One user with a SharePoint Online license - Business Basic upward - is the only hard requirement. No E5, no Purview, no Entra P2. A few optional enrichments, like Purview label sync, use premium SKUs if you already own them.
The 1Security platform
Tenant Inventory Visibility is just the beginning
Tenant Inventory Visibility is one screen of the 1Security platform for Microsoft 365. Locations, devices, apps, AI agents, logs, permissions, sensitive data, compliance, reports and actions run on the same read-only connection, on the licence you already have.
- Activity logs and forensicsUp to three years of searchable activity on a standard licence. What was opened, downloaded, shared, by whom, from where, on which device.
- Anomalies and detectionsSpikes in sharing, downloads, sign-ins, consent and agent activity, scored against each tenant’s own pattern, with curated response actions.
- Permissions and sharingWho can reach what, through which group, link or guest, and whether anyone meant it. The sharing map every audit asks for.
- Sensitive dataPersonal data, credentials, financial and health records found by our own classifiers, with a Microsoft second opinion where the client has it.
- Sensitivity labelsLabel coverage and gaps across sites and files, so the protection the client paid for is actually applied.
- Users, groups and lifecycleDormant accounts, guests who never left, groups nested three deep, orphaned owners, admins without MFA. The review that is a spreadsheet everywhere else.
- Microsoft 365 Alerts ToolOne alert model across policies, activity and anomalies - with the evidence attached and the alert threshold in your hands.
- Microsoft 365 Monitoring ToolReal-time monitoring that catches a mass download while it is unfolding - across users, files, apps, AI agents and devices.
- Copilot Security ToolEvery AI agent's real blast radius - quantified before rollout, watched and constrained after.
- Shadow Device DetectionEvery device touching your data, reconstructed from real activity - including the machines that never enrolled anywhere.
- Impossible Travel DetectionLocations as identities, not IPs: country, city and network for every action, first-seen origins, travel timelines with verdicts - no E5, no P2.
- Conditional Access MonitoringDeclared Conditional Access compared against observed sign-ins: coverage verdicts, ungoverned traffic share, and the ranges your offices outgrew.
- Office 365 Access ManagementEffective access, resolved - who can reach what, through which grant, and one place to take it away.
- SharePoint Governance ToolEvery site ranked by exposure and abandonment - links, guests and Copilot access under control.
- Office 365 User ProvisioningLifecycle access from day one to offboarding - reach, dormant accounts and license reclaim in one flow.
- Microsoft 365 Audit ToolUp to three years of searchable activity history - every action tied to an actor, device and location.
- Microsoft 365 Inventory ToolEight live inventories on one permission graph - including the sites, devices and AI agents that were never registered anywhere.
- Office 365 ReportingAnswers, not exports - regulator-grade numbers, saved views and a read-only API for your SOC.
- Microsoft 365 File PermissionsWho has access to any file, and why - people, links, apps and AI agents on one map, with the fix in the same place.
- Sensitive Data DiscoveryWhere regulated data lives and everything that can reach it - two detection engines, no premium licence required.
- Office 365 Email MonitoringOutbound sensitive content, delegated-send abuse and whole-thread evidence that survives deletion.
- Purview Label CoverageWhat your sensitivity labels actually cover, and which of them protect anything at all.
- AI Agent InventoryEvery agent in the tenant with its real reach counted, its blueprint reviewed, and guardrails you can verify.
- AI Data RestrictionDeclare a data type off-limits to AI and every agent, app and user still reaching it becomes a live violation - recorded for the auditor.
- AI Spend TrackingInteractions, Copilot credits and Azure tokens in one ledger per agent - with the spend column next to what each agent can reach.
- Microsoft 365 User Access ReviewEvery identity with what it can reach, what it did, and whether it should still exist - including SharePoint-only guests that live outside the directory.
- Group Access AnalysisWhat membership in a group actually unlocks - nesting resolved, external members surfaced, blast radius counted.
- App and OAuth Consent GovernanceEvery app with a foothold in the tenant: how it got in, who let it in, and what it can actually read.
- Remediation AutomationFindings become fixes at tenant scale, counted before you enable them and staged behind a review window.
- Microsoft 365 Licence OptimizationThe seats you pay for and nobody uses - unassigned units, licences on guests, and dormant accounts still billing.
- Microsoft 365 Anomaly DetectionEvery policy, user, app and agent measured against its own baseline - with an alert line you move and see the answer to at once.
- Office 365 Sign-in LocationsEvery place your tenant is reached from, with your Conditional Access configuration laid over observed reality.
- Microsoft 365 Unified Audit LogWho did what, when, from where and on which device - retained up to three years on a standard licence.
- SharePoint Site InventoryEvery site, channel site and OneDrive in one list, ranked by external reach, abandonment and what Copilot can read.
- Microsoft 365 Activity AnalyticsThe extremes rather than the averages - a mass download inside the hour, and everything nobody has touched in a year.
- Microsoft 365 Trend TrackingAny number in the tenant followed over time, with the change and the deviation attached - and alerting on the same object.
- Microsoft 365 Compliance MonitoringReadiness for eleven regulations measured from live tenant data - with weekly snapshots and a dated evidence pack per framework.
- Microsoft 365 Security ScoreMicrosoft Secure Score beside the score measured from what actually happens - one worklist ranked by points still on the table.
- External Domain MonitoringEvery organisation your tenant exchanges data with, resolved to a real company - with drift flags and an enforceable verdict per domain.
- All featuresExplore everything
Find out how many sites you really have.
Connect read-only and get your first counts the same day - sites including the hidden ones, guests including the SharePoint-only ones, apps, agents and devices with what each can reach.
Or keep quoting the number from last quarter.