Skip to content
TenantLookout
Sign inGet started
Read-only auditing · $20 per tenant / month

Know your tenants are secure. Every week. One flat rate.

TenantLookout runs automated security checks across your managed tenants — MFA gaps, risky sign-ins, admin roles, mailbox forwarding rules and overshared files — and delivers a plain-English report. No agents to install. No per-seat pricing.

Create an accountHow it works

Automated sign-in auditing for Microsoft 365 business tenants · read-only by design

Six checks. Every week. Zero surprises.

The checks attackers actually use, written up so a business owner can act on them.

MFA coverage
Every account checked for multi-factor authentication. Admins without MFA are flagged critical.
Risky sign-ins
Impossible-travel, anonymous-IP and leaked-credential sign-ins surfaced in plain English, not raw log dumps.
Stale & guest accounts
Disabled, dormant and guest accounts reviewed so former staff and contractors lose access when they should.
Forwarding rules
Hidden mailbox forwarding rules are the classic exfiltration trick. We look for them every week.
Overshared files
SharePoint sites and sharing links walked for anyone-with-the-link exposure.
Admin role review
Who holds Global Administrator? Who got a new role this month? You'll know.

How it works

  1. 1
    Connect once
    A read-only app registration is consented in your tenant admin center. Takes about five minutes; we walk you through it.
  2. 2
    We audit on schedule
    Collectors run daily and weekly against Microsoft's audit APIs. Nothing is installed on your machines.
  3. 3
    Read the report
    Plain-English findings ranked by severity, with a history of what changed since last week.

Read-only. Verifiably.

TenantLookout connects with exactly five read-only directory permissions — listed here in full, because you shouldn't have to take our word for it:

  • AuditLog.Read.All — reads sign-in and audit event logs
  • User.Read.All — reads users, MFA status, stale accounts
  • Directory.Read.All — reads admin roles, guest accounts
  • MailboxSettings.Read — reads mailbox settings such as forwarding rules — never message contents
  • Sites.Read.All — reads site rosters and sharing links

Fine print we're proud of: the mailbox permission reads settings (like forwarding rules) — never message contents. TenantLookout can never send mail, change passwords, or alter your tenant. If we ever request a write permission, this page will say so.

$20/tenant/month
One price. Every check. Unlimited seats on your side.
  • All six checks, weekly
  • Critical findings emailed within the hour they're found
  • 12-month finding history
  • Unlimited users under your account
  • No setup fee, cancel anytime
Start with your first tenant

Billing activates later — accounts created now are free during launch.