Customers & onboarding
Modules explained
What each module assesses, which Microsoft app it uses, whether it is read-only and what the customer sets up after consent.
- Who can do this
- Everyone
- Plan
- All plans
- Time
- 4-minute read
The six modules
Each module is its own multi-tenant Microsoft app, approved separately by the customer's administrator. Assessments only use modules that are enabled and consented.
| Module (app name) | Reads | Access | After consent |
|---|---|---|---|
| Core M365 Assessment – Core | Users, groups, roles and PIM; Conditional Access and authentication methods; enterprise apps and consent grants; Intune devices, compliance and configuration; licenses, usage reports and Secure Score | Read-only (Microsoft Graph). Always required. | — |
| Exchange & Security M365 Assessment – Exchange & Security | Mail flow, transport rules, connectors, forwarding; inbox rules and mailbox configuration; anti-phish / spam / malware, Safe Links / Attachments, DKIM; DLP, sensitivity labels, retention and audit (Purview); Secure Score controls and Defender for Identity sensors | Read-only (Exchange.ManageAsApp + Graph) | Global Reader role |
| SharePoint & OneDrive M365 Assessment – SharePoint | Tenant sharing settings (Graph); site inventory, storage and templates; OneDrive usage summary; owners of group-connected sites | Read-only (Microsoft Graph) | — |
| Microsoft Teams M365 Assessment – Teams | Meeting, messaging and app policies; external / guest access and federation; team inventory and membership counts; Teams Voice and Teams Rooms / phones | Read-only (Graph + Teams PowerShell) | Global Reader role |
| Power Platform (opt-in) M365 Assessment – Power Platform (opt-in) | Environments and environment roles; DLP policies and tenant isolation; apps, flows and custom connectors, and who they are shared with | Not read-only Power Platform management application | Power Platform registration |
| SharePoint Advanced (opt-in) M365 Assessment – SharePoint Advanced (opt-in) | The complete SharePoint / OneDrive tenant configuration (every sharing and access setting). Requires SharePoint & OneDrive. | Not read-only SharePoint Sites.FullControl.All | — |
Which report chapters each module produces
- Core: Tenant profile, the Entra ID chapters (Conditional Access, Authentication Methods & MFA, Administrative Role Assignments, Identity Risk, Users & Guests, Self-Service Policies, Entra Connect / Hybrid Identity, App Registrations, Microsoft-suggested improvements), Intune / Endpoint Manager and License Usage & Optimization. The Secure Score figure on the cover also comes from Core.
- Exchange & Security: Microsoft Defender, the Secure Score chapter, Exchange Online and Microsoft Purview.
- SharePoint & OneDrive: SharePoint Online.
- Microsoft Teams: Microsoft Teams, plus Teams Voice / Phone System when the tenant uses it.
- Power Platform: Power Platform.
- SharePoint Advanced: adds the full tenant-settings audit to the SharePoint Online chapter.
The two opt-in modules
Microsoft only offers some data to apps with write-capable access, so two modules are off by default and clearly labelled Not read-only · opt-in in the portal, the wizard and on Microsoft's consent screen:
- Power Platform (opt-in) registers the app as a Power Platform management application. Microsoft gives such apps the same API access as a Power Platform administrator, with no read-only option.
- SharePoint Advanced (opt-in) uses SharePoint
Sites.FullControl.All, the only permission Microsoft accepts for the SharePoint tenant admin settings. It could change or delete any site; we only read tenant settings with it.
Security note
M365Assessments only issues read calls with the opt-in modules. Selecting one needs an explicit acknowledgement that is recorded in your audit log with your name and the time, and the customer can remove the app at any time.
Good to know
Tenants connected before modules existed use a single app, “M365Assessments Collector”. They keep working until you upgrade them: Legacy tenants and upgrading.
Last updated