Is M365 Health Score Safe?
Yes. M365 Health Score is read-only by design, connects through Microsoft’s own consent screen, never sees your password, and never reads your mail, files or messages. Here’s exactly what it can — and can’t — do.
M365 Health Score is safe to connect. You sign in on Microsoft’s own admin-consent screen, it requests only read-only permissions, it never receives your password, and it cannot change anything in your tenant. Access is revocable by you at any time.
You sign in on Microsoft’s screen
Connecting uses Microsoft’s standard admin-consent OAuth flow — the same one any Microsoft 365 add-on uses. Your credentials are entered on Microsoft’s page, not ours. M365 Health Score only ever receives the tokens Microsoft issues after you approve, and you see the exact permissions before you consent.
Read-only, by design
This is the core of it: the permissions requested contain no write access. There is no technical ability to deactivate an account, move a license, register MFA, or change a policy — because the scopes to do so were never requested.
Exactly what it can read
| Permission | Why it’s needed |
|---|---|
User.Read | Your basic profile, to identify the account running the scan. |
Organization.Read.All | Tenant details and subscribed SKUs, for license-efficiency findings. |
Directory.Read.All | Users, groups and roles, for identity and license checks. |
Reports.Read.All | Usage reports, to identify inactive licensed accounts. |
SecurityEvents.Read.All | Your Microsoft Secure Score and control profiles. |
That’s the complete list. There is no permission here for mailbox content, files, OneDrive, Teams messages, or any write action.
What it never touches
- Your password — it stays with Microsoft.
- Mailbox content, files, OneDrive, or Teams messages — no access is requested.
- Any setting, policy, account or license — read-only means read-only.
Revoke access anytime
Remove M365 Health Score from Entra ID → Enterprise Applications in your Microsoft 365 admin center and access ends immediately — no support ticket, no delay.
What’s retained
To build and re-run your report, M365 Health Score stores your name, email and organization domain, encrypted OAuth tokens, and scan results — license counts and finding flags, never mailbox or file content, because that’s never accessed. Data is kept while your account is active so monthly subscribers can see trends, and you can request full deletion at any time. The full detail is in the privacy policy.
Security & privacy FAQ
Is M365 Health Score safe to connect?
Yes. You connect through Microsoft’s own sign-in and admin-consent screen, and M365 Health Score requests only read-only permissions. You see exactly what’s requested before approving, and can revoke access at any time from your Microsoft 365 admin center.
Does it need my password?
No. You authenticate on Microsoft’s own screen; your password never touches M365 Health Score. It receives only the OAuth tokens Microsoft issues after you consent.
Can it change anything in my tenant?
No. The permissions requested contain no write access. It cannot deactivate accounts, reassign licenses, register MFA, or modify any policy or setting.
Does it read my email, files or Teams messages?
No — and it never requests the permission to. Its access covers license assignments, usage reports, directory structure, your Microsoft Secure Score, and third-party app-consent grants.
How do I revoke access?
In the Microsoft 365 admin center (Entra ID → Enterprise Applications), remove M365 Health Score. Access ends immediately — no need to contact us.
What data do you retain, and can I delete it?
M365 Health Score stores your name, email and organization domain, encrypted OAuth tokens, and scan results (license counts and finding flags — never mailbox or file content). It’s retained while your account is active so you can see trends, and you can request full deletion anytime by emailing hello@m365healthscore.com.
Connect with confidence
Read-only, revocable anytime, and free to run. See your Microsoft 365 Health Score in minutes.