For M365 admins, consultants & MSPs

M365 tenant health, without the detective work.

One read-only scan. One health score. Dollar impact on every finding, and a prioritized fix list — without a single change to your environment.

Read-only Graph access·No credentials stored·No credit card
tenanthawk.io/dashboard
Client overview
Contoso (demo) · last scan 1d ago · next scan in 11h 47m
Health score
Overall grade
D
Open issues
12
−3 since last scan
High severity
5
2 new this week
Recoverable / mo
$2,380
14 unused licenses
Top findingsRanked by risk × dollar impact
HighApp registration secret expires in 6 days
HighLegacy authentication still enabled for 3 protocols
Medium12 E5 licenses assigned to disabled accounts
MediumConditional Access policy changed — 2 exclusions added
Low9 empty groups with no owner

70

essential tenant health checks

M365 · Entra · Intune

connected through read-only Graph

1 score

for security, cost, reliability & hygiene

< 5 min

from consent to your first fix list

Sound familiar?

It's not that you don't care. There's just too much to see.

Every Microsoft 365 tenant accumulates years of quiet drift. The problem was never effort — it's visibility. One scan turns vague dread into a checklist ranked by risk and dollar impact.

Show me what's in my tenant →
01I'm pretty sure something's about to expire… I just don't know what.
02The offboarding ticket closed three weeks ago. The E5 is still assigned.
03Someone changed a Conditional Access policy. Was it safe? No idea.
04This tenant's been through three admins. Nobody fully understands it anymore.
05An app secret expired on a Saturday and took SSO down with it.

What Tenant Hawk scans

Four kinds of tenant debt, one place to clear it.

Every check rolls into your health score with a clear severity, a dollar impact where it matters, and the exact steps to fix it.

01
Security
Catch the gaps before an auditor — or an attacker — does.
Conditional Access gaps, including policies stuck in report-only
MFA registration gaps and legacy auth still enabled
Standing privileged access that should be eligible-only
Over-permissioned enterprise apps & guest sprawl
02
Cost
Stop paying for licenses nobody uses.
Licenses still on disabled accounts, with the $/month figure
Paid seats sitting unassigned or on inactive users
Copilot licenses nobody is actually using
Subscriptions lapsing or stuck in grace period
03
Reliability
Never get blindsided by a silent expiry again.
App registration secrets & certs about to expire
Enterprise app credentials on the same countdown
Intune devices that quietly stopped syncing
Entra devices with stale sign-ins
04
Hygiene
Keep the tenant tidy as it grows.
Inactive users — non-interactive sign-ins considered too
Empty and ownerless groups, teams, and channels
External mailbox forwarding and stale auto-replies
Stale SharePoint sites and org-wide sharing posture

How it works

From “where do I start?” to a checklist.

Under 5 minutes to value

M
Connect Microsoft 365
Read-only · admin consent
Step 01
Connect in 2 minutes

No agents, no passwords, nothing to install. Grant read-only consent — or run a demo scan first.

SecC
CostD
RelA
HygB
Step 02
See the whole picture

70 checks across M365, Entra, and Intune roll into one score out of 100, graded A–F in every category.

Rotate expiring app secretdone
Reclaim 12 unused licenses$684/mo
Review CA policy changehigh
Step 03
Know what to fix first

A prioritized fix-it list ranked by risk and dollar impact, with exact remediation steps for each issue.

For consultants & MSPs

Every client tenant. One clear view.

Manage up to 10 client tenants from one console. Every client gets the full scan — findings with dollar impact, daily rescans, drift alerts, and shareable scorecards for your next check-in.

Portfolio roll-upaverage score, open highs, and recoverable spend across every client at a glance.
Needs-attention queuestale scans, open highs, and connection issues surface before your next check-in.
Per-client scorecardsshareable grades and trends, built for client updates and exec summaries.
Branded subdomain + SSOyour team signs in at acme.tenanthawk.io with Okta, Entra, or SAML.
See Enterprise pricing
Client portfolio8 tenants connected
Avg. score
74
Open high
23
Recoverable / mo
$1,840
N
Northwind Traders
Scanned 2h ago
2 high81 B
F
Fabrikam
Scanned 5h ago
7 high68 D
C
Contoso
Scanned 1d ago
4 high76 C
W
Wingtip Toys
Scan stale · 9d
72 C

Pricing

Think ROI, not subscription lines.

Every scan surfaces reclaimable spend. Recover one unused E5 license (~$57/mo at list) and Pro has already paid for itself.

Founding customers: EARLYBIRD26 for 25% off Pro — first 20 customers
Free
Start with the full product for 14 days — no card. Keep a weekly score after.
$0 forever
14 days of full access — every check, dollar figures included
1 tenant
After the trial: weekly reliability scan (expiring secrets & certs)
Health score & email alerts, forever
Start free
Most popular
Pro
Full visibility for internal IT teams — cost recovery, drift alerts, executive-ready reports.
$49 /tenant/mo
Per internal tenant, billed monthly
All four scan categories
Config Journal — every change with who/what/when diffs
Daily scans + drift alerts
Cost-savings reporting
Category trends & CIS / NIST mapping
Shareable executive report links
AI fix-it guides & exports
Start free scan
EnterpriseFor MSPs
Flat-rate MSP platform — roll up savings across every client tenant.
$299 /mo · 10 clients
Flat rate, billed monthly
Full platform on every client tenant
Up to 10 client tenants (Starter)
Multi-tenant console & roll-ups
Branded subdomain + SSO
Per-client scorecards
Priority support
Get started

Security posture

Built to never touch your tenant.

Every permission, documented →
Read-only by design
Tenant Hawk connects through read-only Microsoft Graph scopes — every permission we request is published, with why. It cannot change a single setting in your tenant.
No credentials stored
Access uses admin consent, not passwords. Revoke the enterprise app in Entra at any time and access ends — no cooperation from us required.
Your data, minimized
Scans store findings and metadata — not mailbox content, files, or messages. Disconnect a tenant and its scan history is deleted with it.

Tenant Hawk is built and run by Dante Cady, an engineer who got tired of running these checks by hand — not an anonymous dashboard. The people answering support wrote the scanner.

Stop wondering what's lurking in your tenant.

Run your first scan free. See your health score, your biggest risks, and your wasted spend in minutes.

Read-only access · no credentials stored · no credit card required