Skip to content
365Posture

How it works

Everything that touches your real tenant data runs inside your own environment. Here is exactly what happens, step by step, from purchase to report.

  1. 1. Buy your assessments

    Choose one or more workloads and a tier (Basic or Advanced) for each, then pay securely via Stripe. You get a confirmation email right away, with a link to download your collector bundle and the SHA256 hashes to verify it.

  2. 2. Download the signed bundle

    Your bundle is a ZIP containing a generated launcher script (Start-Assessments.ps1), the setup script, the collector script for each purchased workload, and shared modules. Every file ships byte-for-byte from 365Posture storage — nothing is patched per order except the launcher, which embeds your order ID and a scoped, time-limited upload URL.

  3. 3. Grant admin consent — in your browser, on Microsoft’s own screen

    Run one PowerShell command. It opens your system browser for a normal Microsoft sign-in (Global Admin or a role with app-registration rights). You approve a new, read-only app registration created in your own tenant, on the Entra consent screen — 365Posture never sees or stores your credentials.

  4. 4. Local collection and tokenisation

    The script queries the Microsoft Graph API directly from your machine, using only the read-only permissions you just approved. Before anything is written to disk for upload, every sensitive value — user names, domains, tenant ID, policy and group names — is replaced with a token (like user1@domain.com or policy3) by a local tokenisation engine. The token map that lets you reverse this is saved to your machine only.

  5. 5. Upload the tokenised artifact

    The tokenised findings are encrypted (AES-256) and uploaded to a per-order, write-only, time-limited URL. Only tokenised, anonymised data ever leaves your environment — 365Posture servers process tokenised data only.

  6. 6. Scoring and your report

    On upload, the assessment is scored against the relevant control library. Basic tier produces an automatically generated PDF report. Advanced tier also has an AI model generate a narrative executive summary and remediation roadmap — built entirely from tokenised data, so no real tenant identifiers are ever sent to the AI. The uploaded artifact is deleted immediately after scoring.

  7. 7. Detokenise locally

    Your report and its PDF use the same tokens as your local token map. A local detokenisation script swaps the tokens back to your real names and domains on your own machine — the readable version of your report never exists on 365Posture’s servers.

The short version

It runs in your tenant. It is read-only. Your data is tokenised locally before anything leaves your environment. 365Posture never sees your real tenant identifiers, and the uploaded artifact is deleted the moment scoring finishes.

Read the full privacy architecture →