One consent away from the answer.

1Security maps every identity in your tenant - human, app, AI agent, device - what each one can reach and what it actually did. Read-only, on the licenses you already own.

Continue with your work account

Your Microsoft 365 identity is the login. Nothing to create, nothing to install.

Read-only to start. Writing anything back is a second consent you can decline.
Runs on the Microsoft licenses you already own - no E5, no Purview.
First results the same day. Most tenants are connected before lunch.

A global admin grants the first consent. Everyone you invite afterwards signs in the same way.

the consent you grantread-only

what it reads

Directory & groupswho exists, who belongs whereread
Sites, files & permissionswho can reach whatread
Sign-in & audit logswhat they actually didread
Apps & AI agentswhat the non-humans can reachread

what it never touches

File contentsunless you switch on the sensitivity scannot granted
Passwords & secretsnever requested, never storednot granted
Anything outside 365no endpoints, no network, no SaaSnot granted

Everything that writes is a second consent. You can decline it.0 writes

microsoft graph · revocable at any time