Microsoft 365 Security Tool
Risky User Analyzer
Find out fast whether a Microsoft 365 account shows signs of compromise: the risk signals that surface after phishing, before an account takeover turns into an incident.
Start free scanHow it works
- 1Sign in with admin consent. Read-only, takes about 30 seconds. Nothing is ever written back to your tenant.
- 2Scan any user in your organization by their email address (UPN).
- 3See the free summary immediately. Unlock the full report when you need the evidence behind it.
What's included
Free
- Overall breach-likelihood and account-risk score
- Per-category severity: Alert, Warning, or OK
- No signup required, no data stored beyond the scan itself
Full report
- Exactly which check triggered, and why
- Evidence: timestamps, sign-in locations, forwarding rules, OAuth grants
- Downloadable as a standalone HTML file
Pricing & demo
Pricing full report
€8.99
One-time payment, per scan. No subscription. VAT included where applicable; see your invoice for the exact breakdown.
Product demo
Frequently asked
What does Risky User Analyzer access in my tenant?
Only what's needed to evaluate one specific user account: sign-in logs, MFA registration, mailbox rules, OAuth consent grants, and directory role membership. It never reads message content, and it never writes anything back to your tenant.
Which Microsoft Graph permissions does it use, and why do they look broader than "one user"?
Nine, all read-only application permissions, none of them .ReadWrite. Every one is actually used by a check below, none are unused leftovers. One thing worth knowing: Microsoft Graph application permissions are always tenant-wide by design, so the admin-consent screen lists them as "read all users" even though our own code only ever looks up the one account you scan. There's no narrower grant Microsoft offers for "read just this one person": that's a platform limit, not a choice we made.
Show all 9 permissions
| Permission | What it's for |
|---|---|
AuditLog.Read.All | Sign-in logs (30 days) and directory audit trail |
Directory.Read.All | Basic profile (creation date, last password change, licenses), the user's roles and groups, plus the tenant-wide OAuth consent list |
Policy.Read.All | Conditional Access policy: does MFA apply to this user? |
UserAuthenticationMethod.Read.All | Which MFA methods are registered |
Application.Read.All | Details of the apps behind any OAuth grants |
MailboxSettings.Read | Inbox rules (suspicious auto-forwarding after account takeover) and mailbox-level forwarding |
Domain.Read.All | The tenant's verified domains |
AuditLogsQuery.Read.All | Readiness check only, no data collected from it |
Contacts.Read | Resolves an internal forwarding address to a readable email address |
Do I need to tell the employee I'm scanning them?
Risky User Analyzer doesn't collect anything beyond what you, as an IT admin, can already see through your own admin role in Microsoft 365: the same data you'd look at during regular security monitoring. It doesn't add a new data source, so it follows the same basis as your existing monitoring practice, not a separate one.
Is the report stored anywhere?
Briefly. The report stays available for up to 2 days after your scan so you can revisit it, then it's automatically deleted. We don't keep a copy after that. If you bought the full report, we keep the payment and invoice record separately, as required by law, but never the report contents itself. See our privacy policy for the full breakdown.
How does payment work?
A one-time payment per scan via Mollie: iDEAL/Wero, credit card, Apple Pay, and Google Pay where available. No subscription, and no card details are ever stored on our side.