EP365 · App for Microsoft 365

SharePoint tenant monitoring and audit

EP365 Atlas the state, risks and readiness of your tenant on one score — any time and without an auditor

Atlas scans your SharePoint Online and sums up its state in a health score — sharing, permissions, governance, storage and AI readiness. Findings carry instructions and you can fix many of them right from the app. All of it inside the Microsoft 365 you already have and pay for, with no third-party cloud.

One number instead of guesswork. A 0–100 health score across five pillars — you know at once how your tenant is doing and where it is on fire.

Findings with instructions, not just a list of problems: each comes with its impact, remediation steps and, for many of them, a button that fixes it right from the app.

Audit without an auditor. What a paid technical audit used to do, you can run yourself at any time — and you can show the difference between scans to an auditor.

Book a 30-minute demo See what it does

Everything runs in your Microsoft 365 Deployed within hours From CZK 1,000 per month

See it in practice

The tenant health score and change watches on the overview, a list of findings by severity and a finding detail with an explanation, the fix procedure and a ready-made command. Click the demo to enlarge it.

Sound familiar?

This is what we hear from companies before they roll out Atlas. Not because IT is doing anything wrong — but because a tenant grows for years and without regular checks nobody can keep track of what is shared, with whom and how sensitive it is.

“We don't know what we share externally, or with whom.”

Anonymous links, guests, sites open to the whole company. It has been piling up for years and today nobody can say where the hole is — until something happens.

“Copilot sees things it shouldn't.”

Before you roll out AI, you need to know what is oversharing and unclassified. Otherwise the assistant instantly surfaces content that had stayed hidden for years only because nobody went looking for it.

“A technical tenant audit costs tens of thousands and is outdated at once.”

An external audit assesses hundreds of settings, issues a report — and three months later it no longer holds. Nobody checks whether the problems come back.

What Atlas does about it

Five things that win back control of your tenant fastest. The complete feature list is further down in the details.

The health score and five pillars at a glance

The overview sums up the state of your tenant as a 0–100 score across five pillars — security, governance, storage, adoption and AI readiness. The score over time, changes since the last scan and a breakdown of findings by area. Leadership gets one number, IT knows where to start.

~~Guesswork and a hope that “it's probably fine”~~ one score and a clear order of what to fix first

Finding · Anonymous links without expiry

Severity: critical

Impact: the link is valid forever, even after a partner leaves

Remediation: set a 30-day expiry

Fix now · written via Graph

Findings you can actually resolve

Every finding has a severity, its impact in plain language and concrete steps. For tenant settings and libraries, the remediation can be launched straight from the app. The state is remembered between scans and a problem that returns is marked as a regression.

~~A list of problems nobody reads to the end~~ findings with a status, a fix and regression tracking

Readiness for AI and Copilot

A separate view of what holds back a safe AI rollout: oversharing, missing classification, outdated sites in the index. Steps that raise your readiness.

Scan comparison and proof of remediation

Pick two snapshots and Atlas shows everything that changed — score, findings, settings, sites, sharing. An ideal monthly attachment for leadership and evidence for an auditor.

Audit log and a full settings audit

Queries over the unified audit log (sharing, deletion, permissions) without PowerShell. Importing Get-SPOTenant unlocks the full ~230 tenant settings checks.

The fastest route: 30 minutes on screen.

No company presentation. We share a screen and run a scan on a sample environment (or, if you wish, on yours) — you will see the score, findings and remediation on live data.

Pick a demo slot Free and with no commitment · online in Teams

What we cover in 30 minutes

5 min Your current practice — how you find out about the state and risks of your tenant today

10 min A live scan: the score, pillars and the most important findings on your own environment

10 min Remediation straight from the app, scan comparison and a report for leadership

5 min What a rollout would mean for you + an indicative price

„For the first time we saw in black and white how many sites were open to the whole company. In two afternoons we brought it down to a handful — and now a score watches it, not luck.“

A company with 240 employees · IT and security · preparing for Microsoft 365 Copilot

Deployed within an hour: adding it to the administrator's SharePoint page, approving permissions and the first full scan. The score and findings were available the same day, without any external service.

0 external services — everything runs in your tenant

5 health pillars in a single score

1×/month scan as a basis for leadership and audit

For those who want to know more

Everything that matters in one place — features, a comparison with the alternatives, security, pricing and answers to common questions.

Health score and pillars

An overall 0–100 score as a weighted average of five pillars (security, governance, storage, adoption, AI). You can adjust the pillar weights to match your organisation's priorities.

A catalogue of check rules

Dozens of named rules across sharing, permissions, governance, storage and tenant settings. Each can be switched off and many have an adjustable threshold.

Findings with status and regressions

New / confirmed / in progress / resolved / exception — the status is remembered between scans. A resolved finding that comes back is marked as a regression.

Fix straight from the app

For tenant settings, the recommended value is written via Microsoft Graph; for libraries, versioning is switched on or permission inheritance restored via SharePoint — no PowerShell.

Exceptions with validity and a note

A specific library, list or a whole finding can be excluded permanently or for a set period, with an explanation of why. When it expires, the finding returns by itself.

Site inventory and structure

All site collections with storage, activity and health. Site detail: permissions, sharing, guests, libraries and lists with metadata, subsites, classification.

Sharing and guests

An inventory of guests from Entra ID including inactive accounts, a breakdown by domain and an overview of the tenant's sharing policy.

Storage and trend

Usage and quotas per site, the largest sites, a growth trend from snapshots and a forecast. An overview of OneDrive sites visible to administrators.

Microsoft Purview audit log

Queries over the unified audit log with a builder (date range, operations, user, keyword) and a warning when auditing is not switched on.

Full tenant settings audit

Graph returns ~30 values; importing the output of Get-SPOTenant unlocks the full ~230 checks (Conditional Access, download blocking, guest expiry, RAC…).

Scan comparison and reports

The difference between two snapshots, a printable health report as a PDF, CSV exports and an email summary after a scan. A reminder for the next scan in Outlook.

AI readiness

Four dimensions (access, classification, authoritative sources, freshness) with checks and recommended steps before rolling out Copilot.

Watches and settings drift

Atlas remembers how your tenant looked and warns you when a setting changes between scans — who and when, with the option to revert the value. Watches can also run a custom audit log query.

Advisor and simulation

For every finding a recommended procedure and an estimate of how many points your score will gain. The “what if I fix it” simulation calculates the impact before you touch the tenant.

Search index health

What isn't in the index, neither users nor Copilot will find. Atlas reads the SharePoint crawl log: when each location was crawled, what failed, what is excluded from search and how long it takes for a new document to become findable — including a listing of the specific content that is lagging.

API load and throttling

When an app slows down because of Microsoft's limits, the culprit is often elsewhere. Atlas collects its own telemetry, shows the pattern across the week and correlates the problem windows with application activity from the audit log.

Targeted audit of a single location

Examines a specific site, library or list without waiting for a scan of the whole tenant — permissions and inheritance, sharing links, settings and content. The result is a report with a score and recommendations to download.

Teams and Microsoft 365 groups

Teams without an owner, public teams, inactive teams and guests in them. Atlas also shows the settings of a specific team and its connected site, so governance isn't handled separately for Teams and separately for SharePoint.

Apps with access to content

Which app registrations read content without a user, with what permissions and who granted them. It includes an overview of secrets and certificates that are about to expire.

Site templates from a live model

You build one model site the way sites in your company should look, and Atlas takes a fingerprint of it — libraries, columns, views, folders, the shape of permissions, Teams channels and pages. New sites are then created from the fingerprint, not from a document nobody maintains.

Document version retention

SharePoint can set a version limit only per library. Atlas determines it by document type, its state and the age of versions — across sites. Cleanup is two-step: first a plan with the volume, deletion only after confirmation, and every run stays in the history.

Area

EP365 Atlas

External tenant audit

Manual checks / scripts

Data stays in your M365

yes, entirely

depends on the vendor

yes

Any time, on demand

you run it yourself

a one-off engagement

time-consuming

Health score and pillars

yes, with a trend

in the report, static

–

Regression tracking between checks

yes, automatically

another engagement

manually

Remediation straight from the tool

tenant and libraries

recommendations only

your own scripts

AI / Copilot readiness

a separate view

depends on the brief

–

Deployment

within hours

weeks

right away, but laborious

No third-party cloud or agents

100% in your tenant

often external collection

yes

Everything runs in your tenant

Scans and snapshots are stored solely in your Microsoft 365. No third-party cloud, no agent, no data transfer outside the company — 100% in-tenant.

Under the signed-in administrator's account

Atlas reads on a delegated basis, with the rights of the signed-in administrator. A deep scan covers only the sites the administrator can access — it grants itself nothing extra.

Read-only until you run an action yourself

Data collection is reading. Writes (fixing a setting, versioning) are triggered solely by an administrator's deliberate click — with a confirmation and an entry in the history.

Roles: administrator vs. reader

Administrators run scans and resolve findings, readers see overviews and reports read-only. Access to data is governed by SharePoint roles, not by the app.

No new passwords

People sign in with their company Microsoft account. Our server serves only to verify licence validity — no tenant data flows through it.

A verifiable history and export

Scan snapshots, comparisons and reports as evidence for NIS2 / ISO and for leadership. The difference between two scans proves remediation without manual digging.

Licence

Price by company size

Up to 25 M365 users

CZK 1,000 / month

26–70 M365 users

CZK 2,000 / month

71–150 M365 users

CZK 3,000 / month

More than 150 M365 users

Individual

The subscription follows the total number of internal users in your Microsoft 365. Within a given size, the number of scans, sites and findings is unlimited.

I'm interested in a licence

Rollout

Implementation at your company

CZK 8,800–17,600 one-off

Installation, permission approval, the first full scan, an administrator workshop and setting the pillar weights, thresholds and roles to fit your organisation.

What is not included

Extensive clean-up of an existing environment, customisation beyond the themes and integration with other systems. We will send a precise quote after a short call.

Extended support

Support rate

CZK 2,200 / hour

Consulting, interpretation of findings, help with remediation or environment changes beyond a standard rollout.

How we count support

Support is billed per each started 15 minutes of work. We always tell you the expected scope in advance.

All prices exclude VAT

Can Atlas tell when content is hard to find?

Yes. It reads the SharePoint crawl log and shows when each location was last crawled, what failed to be crawled and how long it takes for a new document to become findable. For slow bands it lists the specific documents and sites where the delay accumulates — from there you can have the site crawled again.

Can Atlas also watch the number of document versions?

Yes, and with more finesse than SharePoint: the limit is set by document type, its state (for example an approved contract) and the age of versions, across sites or only over sites from one template. Nothing is deleted automatically — Atlas first calculates a plan including the volume that will be freed and cleans up only after confirmation; every run stays in the history.

Does data leave our tenant?

No. Atlas runs 100% in your Microsoft 365, in the browser, under the signed-in administrator's account. Scan snapshots are stored in a SharePoint list on the site where the app runs. Our server serves only to verify the licence — no tenant data flows through it.

Does it need an agent or an external service?

No. No agent, no app registration living without an administrator, no third-party cloud. This sets Atlas apart from most SharePoint management tools, which collect data outside your tenant.

What permissions does Atlas need?

Reading tenant settings, reports, guests and the audit log via Microsoft Graph (delegated). Further permissions are approved for fixing settings and for email summaries / reminders. An IT administrator confirms them once in the SharePoint admin centre; until then the other features work.

Can Atlas also fix the problems, or does it only show them?

Both. For tenant settings it writes the recommended value via Microsoft Graph; for libraries it switches on versioning or restores permission inheritance via SharePoint — always by an administrator's deliberate click, with a confirmation and a record. The remaining findings carry concrete instructions and a ready-made PowerShell command.

What about the audit log?

Atlas queries the unified Microsoft Purview audit log directly from the app. Note: on new tenants, auditing is often switched off by default — Atlas warns you about it and advises where to turn it on. Retention is 180 days (Audit Standard).

Why do some checks mention importing Get-SPOTenant?

Microsoft's public interface returns only part of the tenant settings (~30 values). The complete set (~230) is returned by the PowerShell cmdlet Get-SPOTenant. You paste its output into the app once and unlock the extended checks (Conditional Access, blocking download of infected files, guest expiry, Restricted Access Control…).

Will Atlas help with preparing for Microsoft 365 Copilot?

Yes. A separate AI readiness view assesses exactly what a safe AI rollout rests on: what is overshared with the whole company, what has no classification and what outdated content is within reach of search — and offers steps that raise your readiness.

How long does a rollout take?

Usually within an hour: adding it to a page in your SharePoint, approving permissions and the first full scan. You have the score and findings the same day. A short workshop for administrators is enough for management.

How do app updates work?

You upload the package to your App Catalog just once. New versions are then activated by your admin right inside the app — in Settings, on the Version management card — including rolling back to an earlier version. No repeated package deployments: we ship improvements continuously and you choose when to switch.