man m365reporter
Every customer's Microsoft 365 security, checked, explained and fixed from one portal.
A self-hosted health-check portal for managed service providers and IT teams that look after several Microsoft 365 tenants. It connects to each customer tenant through Microsoft Entra, grades the configuration against a security baseline you choose, and turns the results into clear reports, ready-made fixes and an executive summary your customer can read without signing in. Everything runs on your own server, so customer data never leaves your hands.
Self-hosted with Docker Compose and PostgreSQL.
Images for amd64 and arm64, including Synology NAS.
All your tenants in one place
See every customer tenant, its connection status and what it has granted at a glance. Add a tenant in a few clicks; each one grants read and write permissions separately, in its own tenant.
No more switching between admin portals and customer accounts.
Health reports that cover the whole tenant
Sign-ins, users and inactive accounts, guests, groups, devices and compliance, Defender threats, mail flow, Secure Score with its trend, Conditional Access, PIM, licences, SharePoint and OneDrive storage, expiring app secrets, domains and Azure costs.
One report answers the questions you would otherwise spend an afternoon collecting.
Security baselines with 141 rules across nine products
Entra ID, Conditional Access, Intune, Defender, Exchange Online, SharePoint & OneDrive, Teams, Purview and Microsoft 365, graded against a Low, Mid or High baseline or your own, with current value, expected value and PASS or FAIL.
A consistent, defensible security standard for every customer.
Remediation built in
Every failed rule comes with portal steps and, where it makes sense, a PowerShell script. Conditional Access findings include the policy JSON. More than 60 settings are quick fixes, written straight to the tenant through Microsoft Graph.
Go from finding to fixed in minutes.
Executive summary to share with your customer
A one-page, printable summary in plain language: overall verdict, Secure Score, device compliance, baseline progress, this month's threats and next steps, shared through a link that expires and can be revoked.
Show customers the value of your service in a format management actually reads.
Scheduled, hands-off checks
Run health reports and baseline checks daily, weekly or monthly per customer. A background worker does the work and logs every step.
Problems surface on their own instead of at the next quarterly review.
A full audit trail
Every report, baseline check, applied setting, share link, schedule and access change is logged with who did it: a person or the system.
Transparency for your customers and evidence for audits.
Built for teams
Staff sign in with their Microsoft account; Entra app roles control read, write and delete rights per user per customer. Optional SCIM provisioning adds and removes users automatically.
Give each engineer exactly the customers they need, and nothing more.
Deployment
- Self-hosted – a Docker container with a PostgreSQL database, using Docker Compose. Reports and results stay in your own database.
- Runs almost anywhere – images for amd64 and arm64: a Linux server, a VM, or a Synology NAS through Container Manager.
- Up and running in minutes – a setup wizard creates the local administrator and the Entra app registration with its sign-in addresses, app roles and permissions, or connects one you already have.
- Easy updates – one script pulls the new version and applies database changes at start-up.
Security
- LAN-only if you want – run it on your internal network with a trusted Let's Encrypt certificate through a DNS-01 challenge: no open ports needed.
- Least privilege per tenant – read and write access are granted separately in each tenant. Without write access the app never changes anything.
- Microsoft sign-in with app roles, plus local break-glass accounts protected by TOTP.
- Per-customer permissions – read, write and delete rights per user per customer.
- Secrets protected – the client secret is stored encrypted; share links store only a fingerprint of their token, expire automatically and can be revoked.
- Everything audited – every action on a customer is recorded with its author.
- Microsoft APIs only – tenant data through Microsoft Graph, cost data through the Azure management API.
mail rob@robcloud.nl
Questions about M365 Reporter?
Want a demo, pricing or just to know if it fits your setup? Send a message and I'll get back to you.