Your real tenant data never leaves your environment
365Posture is a security product built for security-conscious M365 admins. Privacy is not a feature bolted on afterward — it is the architecture. Here is exactly how it works.
Tokenisation happens on your machine
Before any collected data is written to disk for upload, the collector script replaces every sensitive value — usernames, admin emails, tenant domain, tenant ID and name, Conditional Access policy names, group names, and the names of devices and domain controllers (shortened to the host name first: the domain part is dropped on your machine) — with a token, using the pattern table below. This happens locally, before encryption, before upload.
The token map never leaves your device
The mapping between real values and tokens is saved locally as an XLSX (human-readable) and a JSON (machine-readable) file on your own machine. It is never uploaded, never transmitted, and never seen by 365Posture. You need it later to see real names in your report.
Servers only ever process tokenised data
365Posture’s backend, database, and scoring engine only ever see tokenised, anonymised values. Real tenant identifiers are never stored on 365Posture servers at any point in the pipeline.
The AI model never sees real tenant data
On the Advanced tier, an AI model generates the narrative executive summary and remediation roadmap. It is given tokenised findings only — never real usernames, domains, or tenant identifiers.
The uploaded artifact is deleted immediately
Once scoring completes, the encrypted, tokenised artifact is deleted from storage right away. It is not retained as a copy of your tenant configuration.
Read-only by default, granted on Microsoft’s own screen
The app registration created for the assessment requests read-only Microsoft Graph API permissions. You approve that permission list on the standard Microsoft Entra admin consent screen before anything runs.
The one exception: SharePoint (full control)
Only if you choose the separate SharePoint (full control) assessment does the 365Posture app hold one write-capable SharePoint permission, Sites.FullControl.All, so that a few SharePoint settings Microsoft shows only with it can be read. The setup script grants it for a few minutes, just before that one read, and removes it right after; it then checks that it is gone, and prints the exact manual steps (and the report shows a warning) if it cannot confirm it. It is never requested on the app registration, you confirm it at checkout and again in the setup script, the certificate key for that run cannot be exported, and tokens issued while it was held stay valid until they expire, about 60 to 90 minutes. The read-only SharePoint assessment never needs it.
The token schema
Every sensitive value is replaced with a predictable, structured token before it ever
leaves your machine. A numeric suffix (_{m})
is added only when needed to handle naming collisions.
| Category | Pattern | Example |
|---|---|---|
| User | user{n}@domain.com | user1@domain.com |
| Admin | admin{n}@domain.com | admin1@domain.com |
| Domain | domain.com | domain.com |
| CA Policy | policy{n} or policy{n}_{m} | policy1, policy1_1 |
| Group | group{n} or group{n}_{m} | group1, group1_1 |
| Device | device{n} or device{n}_{m} | device1, device1_1 |
| Antivirus exclusion (folder, file type or process) | exclusion{n} | exclusion1, exclusion2 |
| Tenant ID | tenant-id-{n} | tenant-id-1 |
| Tenant Name | tenant-name-{n} | tenant-name-1 |
The scored report you receive uses these tokens throughout. When you click “Show real names”, the report page, running in your own browser with your locally-saved token map, swaps them back to your real names and domains. The page makes no network requests, the real names are never saved into the file and are gone when you close or reload the tab, and the readable version of your report is never generated on 365Posture’s servers. (Browser extensions can read any page you open, so open it in a browser you trust.)
What reaches 365Posture, and what doesn’t
Never leaves your tenant
- Real user, admin, and tenant names
- Real domains and tenant ID
- The token map connecting tokens to real values
- Your Microsoft credentials — 365Posture never handles or stores them
Uploaded (tokenised only)
- Encrypted, tokenised findings artifact
- Policy configuration values (states, thresholds, settings)
- Counts and structural metadata used for scoring