Privacy notice
This practical draft explains how Outsight handles data for a Microsoft 365 Tenant Hygiene Snapshot. It is not a legal guarantee and should be reviewed by counsel before broader commercial use.
What Outsight collects
Outsight collects the minimum information needed to generate a read-only Microsoft 365 hygiene snapshot, including tenant identifiers, primary domain/display name, signed-in administrator identity, scan timestamps, summary metrics, and findings returned by Microsoft Graph.
Findings may include user principal names, guest email addresses, group or role names, application names/IDs, app credential expiry metadata, SharePoint site URLs, sharing-policy information, and related hygiene metadata. Outsight does not intentionally collect mailbox content, Teams messages, document contents, passwords, payment card data, or secrets from customer files.
Read-only Microsoft Graph permissions
Outsight requests read-only Microsoft Graph permissions such as
User.Read.All, Directory.Read.All,
AuditLog.Read.All, Application.Read.All,
Policy.Read.All, Sites.Read.All,
Reports.Read.All, and
SharePointTenantSettings.Read.All. These permissions are used
to read tenant hygiene signals and generate the dashboard/PDF report.
Outsight is intended to be read-only and does not remediate, delete, disable, modify, or configure Microsoft 365 resources.
Token storage caveat
To operate the connected tenant experience, Outsight may store Microsoft OAuth access and refresh tokens server-side. Treat this deployment as an early operational system: token storage and hosting controls must be reviewed and hardened before scaling or onboarding sensitive tenants.
Retention and deletion
Scan results and related tenant records are retained only as long as needed to provide the snapshot service, troubleshoot support requests, or meet basic business record obligations. Customers can request deletion of tenant data, reports, and stored tokens by emailing support@example.com.
If you revoke the Enterprise Application consent in Microsoft Entra ID, Outsight will lose future Graph access but you should still request data deletion if you want existing server-side records removed.
No sale of customer data
Outsight does not sell customer tenant data. Data is used to deliver the requested snapshot, improve operational reliability, and respond to support or deletion requests.