Governance Autopilot

Governance Autopilot reads a Microsoft 365 tenant’s configuration and activity signals through Microsoft Graph using read-only, admin-consented application permissions, evaluates them against a catalog of governance policies, and stores the derived results in Solutions2Share-operated Azure services — it never modifies a customer’s tenant data.

Microsoft 365 Certified

Governance Autopilot is a new Solutions2Share product and is not yet Microsoft 365 Certified. Solutions2Share intends to complete Microsoft 365 App Certification as part of the product roadmap. Until certification is granted, the application is developed under the Microsoft Security Development Lifecycle and the practices described on this page.

Data Management Practices

All data is processed on behalf of the customer’s tenant and is isolated per tenant (see Architecture And Flow Diagram). Governance Autopilot performs read-only collection; it does not write to, or change, any customer tenant data. Data is stored in Microsoft Azure data centres operated by Solutions2Share in the Germany West Central (EU) region; the web front-ends are served from the West Europe (EU) region. No customer data leaves the EU.

The application accesses, processes and stores the following data types:

Identity & directory data

User accounts, groups and group memberships, directory roles, and organisation properties. Storage & retention: stored in Azure SQL Database. Current values are kept for the duration of the customer’s subscription; historical versions are retained to show governance trends over time (see Change history below). All customer data is retained for the duration of the subscription and deleted when the subscription ends.

Microsoft Teams collaboration data

Microsoft Teams channels — names, descriptions and membership — used to inventory workspaces and detect ownerless or guest-heavy collaboration. Message content is not read. Storage & retention: stored in Azure SQL Database; same retention as above.

SharePoint & files metadata

SharePoint site inventory and file/site metadata used for storage-hygiene analysis. Governance Autopilot does not extract or retain document contents. Storage & retention: stored in Azure SQL Database; same retention as above.

Audit logs

Directory and sign-in audit logs, used to detect stale sign-ins and gaps in audit configuration. Storage & retention: raw crawl output is first written to an Azure Data Lake per tenant, then merged into Azure SQL Database; same retention as above.

Tenant configuration & policy

Conditional Access and authorization policies, directory role assignments (RBAC), access-review definitions and decisions, and application / service-principal registrations — read to evaluate governance posture. Storage & retention: stored in Azure SQL Database; same retention as above.

Governance analysis results

Derived scores, policy findings, recommendations and analysis snapshots — computed by Governance Autopilot, not read from the tenant. Storage & retention: stored in Azure SQL Database for the life of the subscription. Shareable report links are optional and time-limited (default 14 days, maximum 90 days).

Signed-in administrator identity

Display name, email/UPN, object ID and tenant ID of the administrator who signs in, used to establish identity and gate access. Storage & retention: stored in Azure SQL Database for the life of the subscription.

Change history. Configuration data is versioned (slowly-changing-dimension history) so the product can show how a tenant’s governance posture changes over time. Immutable audit events are appended, not overwritten.

Microsoft Graph

Governance Autopilot uses the Microsoft Graph permissions listed below, on a single multi-tenant Microsoft Entra app registration. Tenant data collection uses read-only application permissions; a tenant administrator grants consent once and background analysis then runs with no user present. The only delegated permission is User.Read, used solely to sign the administrator in — the browser never receives a Microsoft Graph token for tenant data. Scope names are verbatim from the app registration and are rendered as code.

Full descriptions of each permission are published in the Microsoft Graph permissions reference.

SharePoint / other workload permissions

Not applicable in the current release. Governance Autopilot reads SharePoint data through Microsoft Graph (Sites.Read.All, Files.Read.All) only. A future release may add advanced external-sharing checks that require a SharePoint tenant-administration read permission with certificate-based application-only authentication; this is planned and not used today.

Microsoft Teams Apps Security And Compliance

Not applicable. Governance Autopilot is a web application. It is not distributed as a Microsoft Teams app and does not run inside Microsoft Teams.

Architecture And Flow Diagram

Data flow: (1) the tenant administrator signs in to App Service Front (the web front-end), which calls App Service Back (the Governance API); (2) App Service Back validates the product entitlement with the Solutions2Share License Management Center and enqueues an analysis on Service Bus; (3) the Function App reads the customer’s Microsoft 365 tenant through Microsoft Graph (read-only, application-only) and writes raw data to the Storage account; (4) the data is merged into Azure SQL (staging → history) and scored against the governance policies; (5) App Service Back reads the results back for App Service Front. All compute emits telemetry to Application Insights and Log Analytics.

Governance Autopilot uses a hybrid authentication model on one multi-tenant Microsoft Entra app registration, with three deliberately separated flows:

1. Sign-in (delegated). The administrator signs in with their Microsoft work account. The app establishes identity only — no Microsoft Graph permission is requested at sign-in.
2. Consent (application). The administrator grants the read-only Graph application permissions once. Consent is a governed, manual step and is never performed automatically.
3. Analysis (application-only). Background workers authenticate to Microsoft Graph using a certificate held in Azure Key Vault (no shared client secret) and read tenant data. The browser never receives a Graph token.

Per-tenant isolation is enforced by the tenant identifier carried in every token; tokens and data cannot cross tenants.

Resource Endpoints

Domains that a customer’s network or browser must be able to reach.

Backend service egress (informational)

Outbound calls made by the Solutions2Share-operated backend. These are not customer-configurable and are listed for transparency.

Dependencies

Third-party libraries used by Governance Autopilot. Versions reflect the current release.

Server

Client Packages

Build and test tooling

Used only to build and test the app; not shipped to the browser.

Governance Autopilot uses no third-party analytics or advertising trackers. At runtime, customer data is sent only to Microsoft/Azure services and the Solutions2Share License Management Center; web fonts are loaded from the Google Fonts CDN (fonts.googleapis.com, fonts.gstatic.com).