Keep every Microsoft 365 tenant on its baseline.

Deploy, monitor and fix the configuration of every Microsoft 365 tenant you manage, built on the open-source Microsoft365DSC PowerShell module.

Register your organization

Sign in with Microsoft Entra ID. A directory administrator registers your organization once, then an Org Admin gives everyone else access on the Users page.

Every workload Entra ID, Exchange, Intune, SharePoint, Teams and Security & Compliance
Scheduled and real-time Drift scans on your schedule, with results as soon as they're ready
Baselines with promotion Author once, promote from Dev to Staging to Prod, with forks possible per tenant
Entra ID sign-in No passwords to manage, access granted by your organization's administrator

From sign-in to a scanned fleet in one afternoon

  1. Register

    A directory administrator signs in and consents once for the organization. They become its first Org Admin.

  2. Onboard a tenant

    The wizard gives you one script to run, checks the permissions and creates the pipelines.

  3. Scan on a schedule

    Each tenant is checked against its baseline on your schedule, and results show up on the dashboard right away.

  4. Triage and remediate

    Findings are ranked by severity, exceptions are recorded with a reason and an expiry, and reports go out on their own cadence.

Everything a Microsoft 365 operations team needs

One console for configuration, compliance and change across every tenant you manage.

Multi-tenant onboarding

A six-step wizard creates the app registrations, verifies their permissions from your directory and wires the service connections and pipelines.

Drift detection and triage

Scheduled scans compare every tenant with its baseline. Each finding shows its severity and what changed. Exceptions can expire on a set date.

Baselines with promotion

Author a golden configuration once, promote it through Dev, Staging and Prod, and fork it per tenant while merging upstream changes.

Configuration compare

Diff two baseline versions, a tenant against its baseline, or a proposed change against what is live, setting by setting.

Azure DevOps pipelines

Scans and deployments run in your own Azure DevOps project. Progress, logs and artifacts arrive in the dashboard in real time.

Notifications

Tell the right people about drift, failed scans, score drops or expiring exceptions, by email or webhook, either right away or in a daily digest.

Compliance reports

Send summary, drift and trend reports as PDF or CSV for the tenants you choose. Reports are sent daily, weekly or monthly.

Audit trail

Every registration, baseline change, exception, user change and license event, filterable and exportable to CSV.

Roles and access

Org Admins can give people access as Org Admin, Operator, Auditor or Viewer. Everyone signs in with Entra ID.

Two editions, one engine

Both include the open-source Microsoft365DSC PowerShell module and every workload it covers. Enterprise adds unlimited tenants, compliance reporting and the full audit trail.

CapabilityPremiumEnterprise
Managed tenants Up to 15 Unlimited
Configuration export and monitoring ✓ ✓
Drift detection and triage ✓ ✓
Automated deployments ✓ ✓
Configuration compare ✓ ✓
Baselines with promotion ✓ ✓
Notifications (email and webhook) ✓ ✓
Compliance reporting - ✓
Full audit log with export - ✓
Price $49 per seat per month $99 per seat per month

Ready to get started?

Sign in with your work account, register your organization, choose an edition and onboard your first tenant.

Premium and Enterprise editions, licensed per seat. Talk to us about a trial.