Privacy policy
Last updated October 17, 2026
TenantGrade is a read-only health check for Microsoft 365. This page explains exactly what it can see, what it keeps, and for how long. TenantGrade is operated by TenantGrade (“we”, “us”).
Permissions the scan uses
When a Global Administrator approves a scan, Microsoft grants TenantGrade these read-only application permissions in that tenant. Microsoft shows the same list on its consent screen before anything happens.
| Directory.Read.All | Users, groups, licenses, admin roles and domains. |
| AuditLog.Read.All | Last sign-in dates and MFA registration status (needs Entra ID P1; skipped otherwise). |
| Reports.Read.All | Microsoft 365 usage reports, used for last-activity dates when sign-in data isn’t available. |
| Policy.Read.All | Whether security defaults or Conditional Access require MFA. |
| SecurityEvents.Read.All | Your Microsoft Secure Score. |
| SharePointTenantSettings.Read.All | Your SharePoint and OneDrive external sharing level. |
| MailboxSettings.Read | Inbox rules, to spot forwarding to outside addresses. This cannot read email messages. |
None of these permissions can create, change, send or delete anything, and none of them can read the content of email, files, chats or calendars.
What we collect
- Scan results. The findings in your report, including the names and user principal names of accounts that appear in a finding (for example, an admin without MFA), license counts and costs, your organization’s display name and your Microsoft tenant ID.
- Payment details, if you buy a report. Payments are handled by Stripe. We receive the email address you enter at checkout and confirmation that you paid; we never see or store your card number.
- Your email address, if you ask us to email you your summary. Stored with your organization name, grade and estimated license waste so we can send the link and follow up about your results. We don't add you to a newsletter unless you ask, and you can ask us to delete it at any time.
- Monitoring waitlist, if you join it. Your email address, organization name, grade and estimated license waste from your scan, so we can tell you when monthly monitoring launches. Kept until you ask us to remove it.
- Technical logs. Our hosting provider records standard request data such as IP address, browser type and time of request, used for security and troubleshooting.
The scan reads your directory to produce the findings, but we discard that raw data as soon as the findings are computed. We do not keep a copy of your directory, and we never store access tokens or passwords.
How we use it
Only to produce and show your report, process your payment, answer your questions and keep the service secure. We do not sell or rent your data, use it for advertising, or use it to train AI models.
How long we keep it
Scan results are deleted automatically 14 days after the scan. You can delete them sooner with the “Delete” button on your summary or report. Payment records are kept by Stripe as required for tax and accounting. Waitlist entries are kept until monitoring launches or you ask us to remove them, whichever comes first, unless you then sign up.
Service providers
- Microsoft: the scan reads your tenant through Microsoft Graph.
- Cloudflare: hosts the site and stores scan results for 14 days.
- Stripe: processes payments.
- Resend: delivers the summary email, if you ask for one.
Data is processed in the United States and wherever these providers operate.
Removing access
Admin consent stays in place until you remove it, which lets you re-scan later. To remove it at any time: Entra admin center → Identity → Applications → Enterprise applications → TenantGrade → Properties → Delete. After that, TenantGrade can no longer read anything in your tenant.
Your choices
You can delete your scan results at any time, remove the app’s access as described above, or email hello@tenantgrade.app to ask what we hold about you or to have it deleted. TenantGrade is a business service and is not intended for children.
Changes
If we change this policy we’ll update the date at the top. Material changes apply only to scans run after the change.