Your Microsoft 365.
Evidence, not guesswork.
Read-only discovery using a customer-owned single-tenant SPA registration. System8 serves public code—not an identity backend or a tenant data store.
No System8 registration, client secret, backend session or Graph proxy. Tokens and evidence stay in this page's memory. No customer data is collected before your explicit sign-in.
Customer setup—not a System8 application
Customer administrator setup — do this once in your own tenant
- Sign in to the Microsoft Entra admin center and select your own organization's directory. Only proceed with authorization to manage its applications.
- Open Entra ID → App registrations → New registration. Choose Accounts in this organizational directory only.
- Under Authentication, add the Single-page application platform. Copy the exact redirect URI displayed below into that registration. Trusting this origin allows publisher-controlled browser code to access sign-in tokens.
- Use Microsoft Graph Delegated User.Read for baseline access. No client secret, application permissions, implicit grant or device-code public-client-flow setting is needed.
- Copy the public Directory (tenant) ID and Application (client) ID from Overview into the form below. Apply them, then click Sign in with customer tenant and review Microsoft's consent screen.
- Tenant inventory is a separate optional read-only consent step. Your administrator may need to approve it. Missing permissions stay unavailable; consent never grants licenses or directory roles.
Never share passwords or tokens with System8. Do not enter secrets here. Microsoft credentials belong only on Microsoft's sign-in page. Live OAuth/Graph has not yet been verified in an authorized customer pilot.
Use public identifiers from an authorized customer-owned single-tenant SPA registration, not a confidential Web client. Never enter passwords, tokens or secrets. A GUID cannot prove registration ownership. The customer-owned SPA approach is accepted. Until authorized customer admin setup is complete, this dashboard remains setup-only.
Exact SPA redirect URI for this origin: . Configure the registration separately only with customer authorization; no registration is created here. No client secret belongs in a browser SPA.
Memory-only state is lost on reload/navigation. Microsoft's own browser session may still permit reauthentication. Local clearing does not revoke tenant consent or necessarily sign out Microsoft.
Customer-owned setup required. No Microsoft data collected.
Start narrow. Broaden only by choice.
Baseline Graph permission: User.Read for your profile and limited organization identity/verified-domain metadata. MSAL additionally requests openid, profile and offline_access; acquired tokens, including refresh-token cache entries, stay in browser memory. No unattended refresh loop.
Preview optional tenant-inventory access
Separate organization-wide reads: Domain.Read.All, LicenseAssignment.Read.All, User.Read.All. May require administrator consent and supported roles; guest restrictions and policy can deny access. No Organization.Read.All, .default, write permissions or workload bodies. Consent does not establish a license or successful access.
Organization not collected
Verified-domain observations
- Unavailable—not a claim of no domains.
Subscription and user summaries require separate optional consent.
See the boundary of every result.
Unavailable never means healthy.
Missing never means zero.
Trust boundary and deferred work
Browser-local is not immunity from malicious hosting, XSS, extensions or compromised devices. Publisher-controlled JavaScript can access browser tokens; registering this redirect trusts this code origin. Static hosting still sees ordinary asset request metadata. There is no remote telemetry or automatic export.
MFA/security premium analytics, sign-in activity, mailbox/file content, remediation, billing savings, Teams hosting, workspaces and GDAP/reseller onboarding are unsupported/deferred. Sign-in establishes none of those relationships. No security score, contract prices or guaranteed savings are fabricated.
Local custody: 15 minutes idle, 60 minutes absolute. Configuration changes, clearing and expiry cancel collection and invalidate late results. No claim of physical JavaScript heap erasure or independently validated ID-token signatures by this SPA.