Who can open what in your Microsoft 365?

It comes from inside your tenant. The message is sent by the Olyteck app your admin installed in your own Teams, it opens a page signed in with Microsoft, and it never asks for anything but the usual Microsoft sign-in. Before launch, announce the campaign from your own management: we give you the text, to be signed by your IT and security leads. No e-mail from an unknown domain asking staff to "fix their shares".

In France, usually yes, and we make it easy. A campaign shows each employee their own shares: that is processing of employee data. We give you the CSE information notice and the IT-charter clause. What we keep is minimal: name, e-mail, department, counts and campaign events, deleted 90 days after the campaign closes. No ranking of people, no file names, no links.

Expect a minority to do most of the work, and that is enough. Exposure usually sits with a few owners, so the people who act close most of the risk. Reminders stop as soon as someone has nothing left. What remains at the end, IT closes from the console, one click per link.

14 to 35 days, chosen at launch. A campaign starts from a deep scan of 7 days or less (one click: "Run now"). Then messages go out on their own, Monday to Friday, 8:30 to 18:30 in your tenant's time zone. IT time: the launch, a look at the funnel, and the remainder at the end.

Yes — and it is not a setting, it is the permission grant. The scanner application holds 19 Microsoft Graph permissions and every one of them is read-only. It has no write permission of any kind, so there is no code path by which a scan can modify your tenant. It is also the only identity that reads your tenant on a schedule, so nothing on a timer can change a file, site, group or setting (the only other scheduled action is sending the Teams reminders of a campaign you launched).

Fixing what we find is a separate application, and it is optional. Revoking a sharing link or removing a group member needs its own Entra registration, consented separately and revocable on its own. If you never enable it, the product cannot modify your tenant at all — every fix button refuses and tells you which permission it would need. When you do enable it, it acts as the person clicking, with that person's own rights, and the action appears in your own Microsoft audit log.

Don't take our word for it: check Enterprise applications → Permissions in your own tenant, or Security Console → Apps & consent in the product, which reads the live grant from Microsoft on every load. Security review brief (PDF) →

Counts, IDs, and severities — not content. For each finding we store the site, person or app it is about (ID and name), the finding type, the severity, and the timestamp. We do not store file contents, share URLs or email bodies, and the scanner's access tokens are never stored. Two exceptions, both about one person's own choices: a share an employee confirms in My space keeps the file name and their reason, and a fix waiting for an approval keeps its file name for up to 30 minutes. The optional fixing and Teams chat connections keep an encrypted refresh token. See Privacy §3 "SAFE payload" for the precise field list. Database is hosted in the EU. Scan history is available and kept for 90, 180 or 360 days depending on your plan (Voir, Corriger, Piloter; Enterprise: as agreed), then deleted; a resolved finding is deleted 180 days after it was resolved (360 on Piloter).

Correct. Sign in with Microsoft, grant admin consent, and you're in. The 14-day free trial unlocks all 7 modules — SharePoint, OneDrive, Copilot, Identity, Email security, OAuth apps, Posture — with daily scheduled scans, weekly digest, critical alerts, and saved reports. Nothing rolls over to a paid plan automatically. When the trial ends, the product switches to read-only until you pick a plan.

5–15 minutes for most SMB tenants. Heavily-loaded tenants (500+ SharePoint sites) can run longer. The scanner is rate-limited to respect Microsoft Graph throttling and always yields to your users — no impact on production. You can run up to 20 on-demand scans per day during the trial.

Yes. Any scan can be snapshotted to a saved executive report — cover page, trend chart, top findings, auditable timestamp. Share externally via a signed URL with your own expiry, or export findings as CSV for evidence attachments. No re-query needed from the auditor's side.

No end-user impact. All calls go to Microsoft Graph application endpoints using the tenant's own admin consent — not to users' mailboxes or OneDrives. Users won't see a prompt, a notification, or a sharing change. Scans are completely transparent to them.

The product switches to read-only mode. Historical findings and reports stay visible so you can export them, but scheduled scans pause until you pick a paid plan. No credit-card surprise charge. You can revoke admin consent at any time and our scanner loses access immediately.

Yes — see the MSP plan on the pricing page. Each customer tenant gets its own isolated scan database; a single MSP console rolls up findings across tenants. Start with a free trial on one tenant first to get comfortable, then flip the switch.

The opposite — it's your budget request. Every first scan we have run so far found things — including in a well-run tenant whose admin writes his own PowerShell controls. That's the inheritance of Microsoft's defaults and every admin before you — not an audit of you. Most findings take minutes to fix once they're visible, and the dated report turns "we should do something about M365" into a concrete, costed cleanup plan you present on your own terms — before someone else asks the question for you.

The answer, not the settings. Microsoft's consoles are organised by product; Cyber is organised by question: who can reach what, since when, and who fixes it. Three things you will not get from the admin centre: a per-person and per-Team view of every membership, ownership and sharing link (the leaver check and the access review); a Secure Score read against the licences you actually own, so the target is reachable; and delegation — each Team owner sees only their own groups and their own to-do list. See "Doesn't Microsoft already do this?" above. It reads your tenant through Microsoft's own Graph API, read-only, and needs no P2 licence.

Yes — a 20-minute guided first scan. Bring the colleague who holds Global Admin (the consent is one click, by them), and you leave the call with your real findings list on screen. Write to contact@olyteck.com and we'll set it up.