TenantLens
1.3.2
Read-only Entra ID / Microsoft 365 tenant assessment, documentation and drift detection. Exports versionable snapshots via Microsoft Graph, generates human-readable documentation and self-contained offline HTML reports, evaluates a data-driven best-practice rule catalog and detects drift between snapshots.
Minimum PowerShell version
5.1
Installation Options
Owners
Copyright
(c) 2026 Flurin Gubler. All rights reserved.
Package Details
Author(s)
- Flurin Gubler
Tags
EntraID AzureAD Microsoft365 M365 ConditionalAccess Security Assessment Audit Documentation Drift MicrosoftGraph MSP Windows Linux MacOS
Functions
Connect-TenantLens Disconnect-TenantLens Invoke-TenantLens Invoke-TenantLensSnapshot Compare-TenantLensSnapshot Test-TenantLens Get-TenantLensRule New-TenantLensReport New-TenantLensSummaryReport New-TenantLensDocumentation
PSEditions
Dependencies
-
- Microsoft.Graph.Authentication (>= 2.0.0)
Release Notes
https://github.com/xGreeny/tenant-lens/blob/main/CHANGELOG.md
FileList
- TenantLens.nuspec
- TenantLens.psd1
- Private\Get-TLCollector.ps1
- Rules\APP-002.risky-permissions.psd1
- Rules\ID-009.admin-consent-workflow.psd1
- TenantLens.psm1
- Private\Get-TLDefaultScope.ps1
- Rules\APP-003.ownerless-apps.psd1
- Rules\INT-001.compliance-policy-assigned.psd1
- Collectors\Applications.ps1
- Private\Get-TLDriftSeverity.ps1
- Rules\APP-004.client-secrets-in-use.psd1
- Rules\INT-002.app-protection-coverage.psd1
- Collectors\AuthMethods.ps1
- Private\Get-TLFindingsScore.ps1
- Rules\APP-005.granted-high-privilege.psd1
- Rules\INT-003.no-unassigned-profiles.psd1
- Collectors\AuthorizationPolicy.ps1
- Private\Get-TLRuleDefinition.ps1
- Rules\APP-006.risky-delegated-grants.psd1
- Rules\INT-004.compliance-per-platform.psd1
- Collectors\ConditionalAccess.ps1
- Private\Get-TLScoreWeight.ps1
- Rules\AUTH-001.weak-methods-disabled.psd1
- Rules\INT-005.no-stale-devices.psd1
- Collectors\ConsentGrants.ps1
- Private\Get-TLSyncAccountUpn.ps1
- Rules\AUTH-002.registration-campaign.psd1
- Rules\INT-006.devices-encrypted.psd1
- Collectors\CrossTenantAccess.ps1
- Private\Invoke-TLGraphRequest.ps1
- Rules\CA-001.legacy-auth-blocked.psd1
- Rules\INT-007.supported-os-versions.psd1
- Collectors\EmailAuthDns.ps1
- Private\New-TLRuleResult.ps1
- Rules\CA-002.mfa-for-admins.psd1
- Rules\INT-008.no-noncompliant-devices.psd1
- Collectors\Groups.ps1
- Private\Protect-TLSnapshot.ps1
- Rules\CA-003.mfa-for-all-users.psd1
- Rules\LEGACY-001.no-legacy-auth-signins.psd1
- Collectors\IntuneAppProtection.ps1
- Private\Read-TLSnapshot.ps1
- Rules\CA-004.no-stale-report-only.psd1
- Rules\MAIL-001.spf-configured.psd1
- Collectors\IntuneCompliance.ps1
- Private\Resolve-TLAppId.ps1
- Rules\CA-005.break-glass-excluded.psd1
- Rules\MAIL-002.dkim-enabled.psd1
- Collectors\IntuneConfiguration.ps1
- Private\Resolve-TLDnsRecord.ps1
- Rules\CA-006.compliant-device-or-mfa.psd1
- Rules\MAIL-003.dmarc-enforced.psd1
- Collectors\LegacyAuthSignIns.ps1
- Private\Resolve-TLObjectId.ps1
- Rules\CA-007.trusted-locations-scoped.psd1
- Rules\MFA-001.registration-coverage.psd1
- Collectors\ManagedDevices.ps1
- Private\Write-TLFile.ps1
- Rules\CA-008.risk-based-policies.psd1
- Rules\MFA-002.no-admin-without-mfa.psd1
- Collectors\MfaRegistration.ps1
- Private\Write-TLManifest.ps1
- Rules\CA-009.no-ineffective-policies.psd1
- Rules\MFA-003.admins-phishing-resistant.psd1
- Collectors\NamedLocations.ps1
- Public\Compare-TenantLensSnapshot.ps1
- Rules\DOM-001.password-expiry-disabled.psd1
- Rules\SPO-001.external-sharing-restricted.psd1
- Collectors\RoleAssignments.ps1
- Public\Connect-TenantLens.ps1
- Rules\GRP-001.no-ownerless-m365-groups.psd1
- Rules\SPO-002.legacy-auth-disabled.psd1
- Collectors\SharePointSettings.ps1
- Public\Disconnect-TenantLens.ps1
- Rules\GRP-002.no-public-m365-groups.psd1
- Rules\STALE-001.no-stale-enabled-users.psd1
- Collectors\StaleAccounts.ps1
- Public\Get-TenantLensRule.ps1
- Rules\ID-001.global-admin-count.psd1
- Rules\STALE-002.no-never-signed-in-guests.psd1
- Collectors\TenantBasics.ps1
- Public\Invoke-TenantLens.ps1
- Rules\ID-002.pim-over-permanent.psd1
- Rules\STALE-003.shared-mailbox-signin-blocked.psd1
- Config\volatile-properties.psd1
- Public\Invoke-TenantLensSnapshot.ps1
- Rules\ID-003.security-defaults-coherence.psd1
- Rules\TEN-001.unused-licenses.psd1
- Private\Compare-TLValue.ps1
- Public\New-TenantLensDocumentation.ps1
- Rules\ID-004.guest-invites-restricted.psd1
- Rules\XT-001.no-automatic-consent-defaults.psd1
- Private\ConvertTo-TLHtml.ps1
- Public\New-TenantLensReport.ps1
- Rules\ID-005.user-consent-restricted.psd1
- Templates\drift.html
- Private\ConvertTo-TLNormalizedObject.ps1
- Public\New-TenantLensSummaryReport.ps1
- Rules\ID-006.guest-access-restricted.psd1
- Templates\report.html
- Private\Format-TLDocumentation.ps1
- Public\Test-TenantLens.ps1
- Rules\ID-007.no-service-accounts-privileged.psd1
- Templates\summary.html
- Rules\APP-001.expiring-credentials.psd1
- Rules\ID-008.no-guests-privileged.psd1