Read-only Microsoft Purview posture analyzer (modernized CAMP). Reads configuration metadata across Sensitivity Labels, DLP, Retention, Insider Risk, Audit, eDiscovery, Communication Compliance and DSPM for AI, and produces an HTML report (primary) plus a JSON export. Collectors call Get-* only; no tenant configuration is created, modified or delet... More info

Read-only Microsoft Intune evidence explorer. Quick start: Install-Module -Name IntuneAccess -Scope CurrentUser; Start-IntuneAccess

Answers one question before December 2026: which mailboxes in this tenant can still send with a username and password, and will therefore stop when Microsoft disables SMTP AUTH Basic authentication by default at the end of that month. Printers, scanners, MFPs, NAS units and scripts are what break, and the error they will report is 535 5.7.139. Rea... More info

Read-only Microsoft Entra ID unmanaged and stale device reporting via Microsoft Graph. Generates CSV evidence for device-exposure assessment findings; performs no writes to any tenant.

Read-only Microsoft Entra ID multifactor authentication registration reporting via Microsoft Graph. Generates CSV evidence identifying users without MFA registered, for MFA-coverage assessment findings; performs no writes to any tenant.

Read-only Conditional Access policy inventory and unique-values catalogue module, built on the Microsoft Graph PowerShell SDK. Retrieves every Conditional Access policy in a tenant, normalises each into a flat per-policy record, and aggregates a deduplicated catalogue of the distinct values in use (workloads, grant controls, platforms, locations, c... More info

Read-only inventory of unassigned, mis-assigned and leftover Windows Intune objects, and optionally owner-scoped Entra ID assignment groups. Produces an Excel decision tracker. Issues GET requests only and never modifies a tenant.

SqlCertForge (audit edition) -- READ-ONLY inventory and verification of SQL Server and Reporting Services (SSRS/PBIRS) TLS certificate bindings and HTTPS endpoints. Reports what is bound and whether endpoints actually serve; makes NO changes. The free/community surface; state-changing provisioning lives in the full SqlCertForge module.