You're in the demo.
Three fictional clients with made-up people. Look around freely: nothing can be changed, and it all resets every night.Get Office Sentry
Greyed-out features aren't licensed, so the checks that need them show as "not checked".
Data sources
39 of 40 collected fine · 1 to look at · collected automatically every night
Source
Status
Last collected
Automatic repliesWhich mailboxes have an out-of-office reply on or scheduled, and who it goes to.Could not read automatic replies for 18 of 22 mailboxes
Admin rolesWho holds each directory role, active and PIM-eligible, including through groups and people who can activate membership of such a group (PIM for groups).
Admin activityAdmin role, Conditional Access, app credential, consent, domain and account changes from the directory audit log, kept in the activity history (Microsoft keeps 30 days with Entra ID P1, otherwise 7).
Sharing and consent settingsGuest invitations, user consent to apps, default user permissions, admin consent requests, and SharePoint external sharing.
Deleted users and groupsUsers and Microsoft 365 groups in the Entra ID recycle bin, and how many days are left to restore each before Microsoft deletes it for good.
Sign-in activityInteractive sign-ins in the last 7 days, summarised by account, country, app and failure reason (needs Entra ID P1; sign-in risk needs P2).
DevicesDevices registered or joined to Entra ID, which have a BitLocker recovery key saved, and Intune compliance, encryption and check-in for managed devices (needs Intune).
Intune policiesIntune compliance policies, configuration profiles and Windows update rings, settings catalog and endpoint security policies, and app protection for iOS and Android, with whom each is assigned to (needs Intune).
Directory syncWhether accounts are synced from on-premises Active Directory, when directory and password hash sync last ran, and how each domain signs in and how often its passwords expire.
Shared filesEvery file and folder in SharePoint and OneDrive shared with anyone, the whole organisation, people outside it, or given its own permissions. Needs the Sites.Read.All permission.
SharePoint storageWhat fills each site's storage: libraries, folders, large and old files, version history and recycle bins. Needs the Sites.Read.All permission.
Site permissionsPermission levels on each SharePoint site, SharePoint groups and their members, and lists, libraries and subsites with permissions of their own. Needs Sites.Read.All on SharePoint (not Graph).
Site accessWho owns, administers and can reach each SharePoint site: group owners and site admins, guests, what the default library grants, and sites open to everyone. Needs the Sites.Read.All permission.
TeamsEach team's channels, the guests and people from other organisations in private and shared channels, the apps added to each team, and when each team was last used.
Mail flowHow much mail each domain sends and receives, how much is delivered, sent to Junk, quarantined or failed, and who gets the most spam and phishing (needs Global Reader).
Mail rules and protectionMail flow rules, connectors, and the anti-spam, anti-phishing and anti-malware policies (with Safe Links and Safe Attachments where Defender for Office 365 is licensed) and whom each applies to (needs Global Reader).
Administrative unitsEvery administrative unit, whether it is assigned or dynamic and restricted, and the users, groups and devices in each. The admins scoped to each unit come from Admin roles.