Tenant Healthcheck

The Tenant Healthcheck product scans your Microsoft 365 tenant configuration against industry best practices and operational standards. It runs entirely through your Calibrant Relay using Managed Identity — Calibrant stores no Microsoft password, client secret, or tenant token.

How it works

1. Review Tenant Context (recommended) to record stable facts Microsoft cannot determine
2. Click Start Full Scan to check the complete tenant scope
3. Calibrant sends PowerShell scripts to your relay as commands
4. The relay executes each script using its Managed Identity (no user credentials)
5. Results are returned to Calibrant and evaluated against health rules weighted by severity
6. If Microsoft evidence needs interpretation, the scan reuses a matching saved answer or asks a focused inline question about scope, intent, exclusions, policy quality, or an allowed outside safeguard
7. After all required context is complete, one final verdict per control and the score are published together
8. For an eligible final scan, optional Claude AI analysis can generate an executive summary and prioritized recommendations

AI enrichment runs only after the deterministic result qualifies as final. Awaiting-context, provisional, or incomplete-evidence scans are not sent for AI analysis, so generated text cannot lend authority to an incomplete audit.

For details on running scans, understanding scores, and reading results, see the Scanning guide.

Prerequisites

1. Microsoft commercial cloud tenant — Microsoft 365 GCC, GCC High, DoD, China/21Vianet, and every other sovereign or national cloud are not supported. Calibrant treats an unsupported license portfolio as unknown; it never uses it to remove checks from a score.
2. Relay deployed and online — follow the Relay Setup guide
3. Managed Identity permissions granted — the relay's Managed Identity needs 18 read-only Graph app roles, Exchange.ManageAsApp for app authentication, and the Global Reader directory role that limits Exchange authority to read-only commands. It holds no administrator role. The Power Platform category additionally needs a management-application registration that is not read-only and is optional — read Step 5 of the Relay Setup guide before running the permission grant script.
4. Active access — Tenant Healthcheck is included in the 14-day trial and in both Essential and Pro.

Check categories

Every scan evaluates all eight categories so scores remain comparable over time. Calibrant detects Microsoft licensing from the tenant evidence and marks genuinely unlicensed workloads as not applicable rather than treating them as healthy. If licensing inventory cannot be read, affected checks remain unavailable rather than being guessed as licensed or unlicensed.

Microsoft 365 Backup combines machine evidence with administrator context. If Microsoft's native Backup service is not registered in the tenant, Calibrant does not treat Microsoft's 403 AppNotRegistered response as a permission failure or a failed backup control. An inline follow-up can instead document a third-party backup service, protected scope, and restore testing with an evidence reference. A missing BackupRestore-Configuration.Read.All grant still fails collection loudly, because the relay verifies the role in its token before accepting the unregistered service response.

Microsoft Graph does not expose the separate OneDrive external-sharing slider. Calibrant therefore reads the SharePoint sharing level, pauses the unpublished result, and asks an owner or administrator to confirm whether OneDrive is equal or more restrictive. The answer is reused only while the SharePoint evidence and evaluation rules remain unchanged. This preserves an honest Healthcheck verdict without granting SharePoint Administrator.

Scan cost

Scans are included in your subscription and don't consume credits — run them on demand as often as you need. On the Pro plan you can also enable weekly automatic scans in Settings.

Printable report and PDF export

Owners and administrators can open a printable report for any completed, integrity-verified scan and download it as a PDF (available on every plan). The document renders from the scan's own frozen record — the override policy and questionnaire answers captured with that scan, never today's edits — and includes every finding with its result message and remediation. Rendering happens on Calibrant's own servers from the same frozen evidence as the on-screen page; no third-party rendering service is involved. Scans without verified findings refuse to export rather than producing an incomplete document.

To export: open Healthcheck, select a completed scan, and find the Report and PDF buttons in the findings header, beside CSV. Report opens the printable document in a new tab (with its own Download PDF button at the top right); PDF renders and downloads it directly, taking a few seconds. The buttons appear only for owners and administrators, and only on scans whose findings are integrity-verified.

A Healthcheck scan report is the frozen record of that one scan, so any completed scan with verified findings can be exported at any time — including older ones. This differs from the Security Baseline assessment report, which is a living document and only renders against the current ruleset.

Next steps