What this tool does
A read-only scan of your Microsoft 365 tenant that maps your network access landscape, so you can see what changes if you move to Secure Access.
App inventory
Every enterprise app + app registration, with its identity and app ID.
Access patterns
Top apps by sign-in and risky sign-ins (a sample of recent activity).
Conditional Access
Your policies — enabled vs disabled — as a starting point.
Vendor detection
Possible presence of Zscaler, Cisco, Netskope, Prisma… and your coexistence path.
What we read — and why
You sign in with Microsoft and grant read-only access. We never modify anything.
| Permission | Why |
|---|---|
| User.Read | Your name and email — to sign you in |
| Application.Read.All | Your app inventory |
| Policy.Read.All | Your Conditional Access policies |
| AuditLog.Read.All | Your sign-in logs (access patterns) |
| Organization.Read.All | Your tenant name and domains |
| NetworkAccess.Read.All | Your GSA forwarding profiles (admin consent) |
These are granted by your admin (admin consent). AuditLog.Read.All (sign-in logs) additionally requires an Entra ID P1 license, and NetworkAccess.Read.All (GSA profiles) requires admin consent — without them, those sections show as unavailable.
Sign in to scan your tenant
You'll grant read-only access to directory, apps, policy, sign-in logs and GSA configuration. Nothing is stored — analysis runs in your browser.
Passbeck Discovery is an independent tool and is not affiliated with Microsoft. You sign in with your own Microsoft account and grant read-only access. Your tenant data is read directly from Microsoft Graph by your browser and analysed locally — Passbeck receives none of it and stores nothing on our side. The client-side source is public, so you can verify this yourself.
How to revoke: Entra admin center → Identity → Applications → Enterprise applications → "Passbeck Discovery" → Remove. Or revoke from myaccount.microsoft.com.
No consent to Passbeck? Use your own Graph connection
Regulated buyers can run the same scan locally with their own Microsoft Graph credentials and upload the result — no consent to Passbeck required. The script still needs its own read-only Graph permissions.
Run export-gsa-discovery.ps1 in your tenant, then upload the JSON here.