Argus | M365 Administration

👤 Entra — List Users—

🛡 Entra — CA Policies—

🔍 Entra — Risky Users—

💻 Intune — Managed Devices—

💻 Intune — Compliance Policies—

💻 Intune — Audit Events—

📧 Exchange — Mailbox Report—

🔑 Licensing — Subscribed SKUs—

🛡 Security — Secure Score—

🛡 Security — Alerts—

📋 Audit — Directory Logs—

📱 Intune — MAM Policies—

⚠ Required Entra Roles & Permissions

The App Registration needs admin-consented API permissions, and the signed-in admin account needs the Entra roles below for each section to load correctly.

👤 Identity / CA PoliciesSecurity Reader or Global Administrator

🔍 Risky Users / MFASecurity Reader or Global Administrator — requires Entra ID P2

👤 Stale AccountsReports Reader or Global Administrator

💻 Devices / IntuneIntune Service Administrator or Global Administrator — 401 (not 403) if missing

🛡 Security AlertsSecurity Reader or Security Administrator — AND — SecurityAlert.Read.All on the App Registration

🔄 Audit LogsReports Reader or Compliance Administrator or Global Administrator

📧 Exchange ReportsReports Reader or Exchange Administrator or Global Administrator

⚠ After adding new permissions or roles, you must sign out and back in — a token refresh alone will not pick up new scopes.

🏠

Tenant Summary Report

A point-in-time snapshot of your M365 tenant for management reporting or audit evidence. Downloads as a self-contained HTML file.

Includes:
· Security Posture Score (all findings, RAG status)
· Identity & access stats + risky users
· Device compliance + non-compliant list
· Licence consumption by SKU
· Microsoft Secure Score

💻

Full Asset Inventory

Complete device register for Cyber Essentials certification, insurance records, and ongoing IT documentation. Exports as a multi-sheet Excel workbook.

Includes:
· All devices — serial, OS version, last sync, user
· OS & patch version breakdown (CE requirement)
· Compliance status with non-compliant detail
· Corporate vs personal device split
· Summary stats & fleet coverage

🔑

Admin & Role Permissions

Full Entra ID role assignment audit — who holds what permissions across your tenant. Ideal for access reviews, audit evidence, and Cyber Essentials "least privilege" checks.

Includes:
· Global Admins — dedicated list with last sign-in
· All Entra directory role assignments
· Per-user view of all roles held
· Per-role view of all members
· Summary — role counts & privileged user count

${[ ['User.Read.All','Read all users, MFA registration, sign-in activity'], ['Directory.Read.All','Read directory objects, CA policies, roles'], ['AuditLog.Read.All','Read Entra and Intune audit logs'], ['IdentityRiskyUser.Read.All','Read risky user detections (P2)'], ['IdentityRiskEvent.Read.All','Read risk events / detections (P2)'], ['Policy.Read.All','Read Conditional Access and auth policies'], ['DeviceManagementManagedDevices.Read.All','Read Intune managed devices'], ['DeviceManagementConfiguration.Read.All','Read Intune config profiles'], ['DeviceManagementApps.Read.All','Read MAM/app protection policies'], ['Reports.Read.All','Read usage and mailbox reports'], ['SecurityEvents.Read.All','Read Secure Score and legacy alerts'], ['SecurityAlert.Read.All','Read unified Defender alerts (v2 API)'], ['Organization.Read.All','Read tenant organisation details'], ['Sites.Read.All','Read SharePoint — Exchange stats JSON'], ].map(([scope,desc])=>`

${scope}

${desc}

`).join('')}

👤 Identity / CA PoliciesSecurity Reader or Global Administrator

🔍 Risky Users / Risk EventsSecurity Reader or Global Administrator — requires Entra ID P2

👤 Stale AccountsReports Reader or Global Administrator

💻 Devices / IntuneIntune Service Administrator or Global Administrator — returns 401 (not 403) if missing

🛡 Security AlertsSecurity Reader or Security Administrator — AND — SecurityAlert.Read.All on the App Registration

🔄 Audit LogsReports Reader or Compliance Administrator or Global Administrator

📧 Exchange ReportsReports Reader or Exchange Administrator or Global Administrator

Automation Account: E4-AA-ITDashboard-ExchangeData in resource group Era4-Automation-rg

SharePoint path: Documentation/Dashboard Data/mailbox-stats.json on the IT site

Managed Identity permissions (Graph app roles): Reports.Read.All · MailboxSettings.Read · Sites.ReadWrite.All

Grant MailboxSettings.Read — run in Azure Cloud Shell:

$sp = Get-MgServicePrincipal -Filter "displayName eq 'Era4 IT Automation'"
$graph = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
$role = $graph.AppRoles | Where-Object { $_.Value -eq 'MailboxSettings.Read' }
New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $sp.Id `
    -PrincipalId $sp.Id -ResourceId $graph.Id -AppRoleId $role.Id

To trigger the runbook manually, use the Refresh Dashboard Data button on the Exchange tab. To schedule it nightly, create a schedule in the Automation Account and link it to the runbook.

${[ ['Entra Admin Centre','https://entra.microsoft.com'], ['App Registrations','https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/RegisteredApps'], ['Conditional Access','https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ConditionalAccessBlade/~/Policies'], ['Intune Admin Centre','https://intune.microsoft.com'], ['Microsoft Defender','https://security.microsoft.com'], ['Secure Score','https://security.microsoft.com/securescore'], ['Microsoft Purview','https://compliance.microsoft.com'], ['Azure Automation','https://portal.azure.com/#browse/Microsoft.Automation%2FAutomationAccounts'], ['M365 Admin Centre','https://admin.microsoft.com'], ['Exchange Admin Centre','https://admin.exchange.microsoft.com'], ['SharePoint Admin','https://era4-admin.sharepoint.com/_layouts/15/online/AdminHome.aspx'], ['Azure Portal','https://portal.azure.com'], ].map(([label,url])=>`${label} ↗`).join('')}

—

🚀 What's New ▼ Collapse

New Jun 2026 Security Recommendations — 15 best-practice cards on the Security tab covering MFA, legacy auth, PIM, Defender, DMARC, DLP, audit logs and more. Each card shows an auto-detected RAG status where data is available and links directly to the relevant Microsoft admin portal.

New Jun 2026 Top Secure Score Actions — Security tab now shows your top 10 unimplemented Secure Score controls sorted by maximum points, each linking directly to the remediation page in the relevant admin portal.

New Jun 2026 Identity Risk Events — Live feed of recent Entra ID risk detections (leaked credentials, impossible travel, unfamiliar locations) on the Security tab. Requires IdentityRiskEvent.Read.All and an Entra ID P2 licence.

New Jun 2026 Asset Finance Tab — Complete fleet cost view across all Intune-managed devices. RRP pricing for 100+ device models (Dell, Apple, Lenovo, Surface, Samsung), category breakdown charts, virtual device exclusion, and an optional online price lookup via Google Custom Search.

New Jun 2026 Licence Name Mapping — Licensing tab now shows friendly names for 90+ Microsoft SKUs instead of raw part numbers (e.g. FLOW_FREE → Power Automate Free, CPC_E_2C_8GB_128GB → Windows 365 Enterprise 2 vCPU / 8 GB / 128 GB). Unknown SKUs auto-format as readable text.

New Jun 2026 Directory & Asset Lookup — Search any user or device by name. See a full identity profile (MFA, sign-in, mailbox, groups, roles) and drill into any associated device for hardware, compliance and security details — with a product photo when configured.

New May 2026 Exchange Stats via Azure Automation — Mailbox counts, active/inactive breakdown, storage totals and external forwarding detection now pulled nightly by an Azure Automation Runbook writing JSON to SharePoint. No Exchange module required — pure Graph API.

New May 2026 Azure Static Web App Hosting — Dashboard hosted at gentle-field-0a0648210.7.azurestaticapps.net. Access from any browser without a local server. CI/CD pipeline deploys automatically on every push to GitHub.

New May 2026 Configuration Tab — Live view of Intune compliance policies, device configuration profiles, Conditional Access rules, authentication methods, and MAM/app protection policies all in one place.

New May 2026 Recent Changes Feed — Unified audit log showing the last 7 days of changes across Entra ID and Intune, merged into a single chronological timeline with actor and target details.

—

/ 100

Security Posture Score

Based on — security checks across your M365 tenant

✓ 0 Good ⚠ 0 Warning ✗ 0 Critical — 0 N/A

👤 Identity

💻 Devices

📧 Exchange

🛡 Security

🔴

—

High Alerts

🟡

—

Medium Alerts

🔵

—

Total Active

⚡ Recent Security Alerts Latest 5 active — View all →

All Findings All checks across every category

Loading findings…

Conditional Access Policies

MFA & Auth Registration

Risky Users

Stale & Inactive Accounts No sign-in for 90+ days

Compliance by Platform

Compliance Breakdown

Non-Compliant Devices

Compliance Policies

Configuration Policies

📧 Email Activity Last 7 days · Reports API

🌐 Accepted Domains

🔗 Mail Flow Admin Opens Exchange/Defender

🔄 Exchange Data Export Runs the Azure Automation runbook that feeds Mailbox Usage, Timezones & External Forwarding below

Mailbox Usage Last 30 days · Reports API

🌍 Mailbox Timezones Azure Automation · nightly — expected: GMT Standard Time

📤 External Forwarding Azure Automation · nightly

Consumption by SKU

Full License Detail

🛡 Microsoft Secure Score

📊 Alert Severity Breakdown

🎯 Top Secure Score Actions Highest impact — click to open in Microsoft Secure Score

⚠ Identity Risk Events Last 15 · newest first · Open in Entra ↗

📋 Security Recommendations Microsoft 365 best practice checklist — click any card to open the relevant admin portal

🔔 Recent Security Alerts Last 20 · newest first · Open in Defender ↗

📋 All Recent Activity Combined Entra + Intune — last 30 days

🗂 Entra / Directory Changes

💻 Intune / Device Changes

⚙ Tenant Configuration Snapshot Current settings pulled live from Microsoft Graph

🔒 Compliance Policies

📱 Device Configuration Profiles

🛡 Conditional Access Policies

🔑 Authentication Methods Tenant-wide settings

📦 App Protection / MAM Policies

🔍 Directory & Asset Lookup Search by username, email or device name

— Total Fleet Value —

— Managed Devices —

— Devices Priced Avg —

— Unpriced Physical Devices Virtual machines excluded

🥧 Fleet Value by Category

📦 Device Count by Category

📊 Fleet Value by Category Click a tile to filter the table

Loading…

📋 Device Inventory

View:

Loading device data…

📊 Overall Status

📦 Status by Device Type

🩹 Device Patch Status

Loading devices…

⚠ Patch status is evaluated against a reference table verified 2026-07-23. Update WIN_REF / MAC_REF in the dashboard script after each Patch Tuesday. Devices marked Unknown mean the build/version isn't in the reference table yet. Windows 10 is always EOL regardless of patch level (standard support ended 2025-10-14).

🔍 Token & API Diagnostics

Current Token

Granted Scopes (from your token)

Required Permissions Checklist

Live API Tests — click to run

What to do if Devices shows 401

📄 Reports

📖 Documentation & Setup Guide

Entra App Registration — Quick Setup

Required Microsoft Graph API Permissions

Required Entra Roles (for the signed-in admin account)

Exchange Stats — Azure Automation Setup

Troubleshooting

Useful Admin Portal Links

Security Posture Score

💻 Device Details