A license audit needs to read licenses, users and mailboxes, and nothing else. So GlacierPoint Ledger asks for read permissions only, holds no standing access to any tenant, and has no code that writes to one. The work is done by an app on your computer, signed in as you; the portal prices and shows what the app read, encrypted at rest, for the members of your workspace.
Only people in your organization, with their own sign-in, and only to read.
Every check is a read. The app asks for the five read permissions below on Microsoft's own sign-in page, and the consent card names each one. There is no write permission in the product, so there is nothing to misuse: it cannot release a license, disable a user or change a mailbox.
We hold no password, token, client secret or certificate for any tenant, and there is no support account or back door. Nobody at GlacierPoint Ledger can read your tenant; the app on your computer does, signed in as you.
Interactive sign-ins are held in memory by the app, never written to disk, never shown and never sent to the portal. They are discarded when you sign out or close the app.
With Watch and MSP, unattended runs use an app registration your organization owns, created by a one-time setup you see every line of, and a certificate whose private key is kept by Windows on that computer and never leaves it.
The app only signs in, reads, seals and uploads. It takes no command from the portal and runs nothing the portal sends; the portal evaluates and renders.
No agent, no mailbox rule, no service principal with standing permissions unless you choose scheduled runs, and then one you own and can remove at any time.
Asked at sign-in, with a consent card that says "Granted: N of M". Every one is a read.
| Permission | What it reads | For which checks |
|---|---|---|
Organization.Read.All | The subscriptions: purchased, assigned, suspended and warning units, trial and end dates | Unassigned licenses, subscriptions ending, the overlap map |
Directory.Read.All | Licenses and service plans per user, how each was assigned, assignment states | Overlapping licenses, service plans disabled, assignment errors, add-ons without a base |
User.Read.All | Users and guests: account state, creation date, type | Disabled users, never-activated users, guests |
AuditLog.Read.All | Sign-in activity: the last interactive and non-interactive sign-in | Stale users, stale guests, never-activated users |
Reports.Read.All | Usage reports; optional | Context on the report |
| Exchange Online administrator read | Shared, room and equipment mailboxes, their size, archive and litigation hold | Shared and resource mailboxes with licenses |
Sign-in activity needs Entra ID P1 or P2 in the tenant. Without it the stale-users check says "needs Entra ID P1" and falls back to the creation date and "never signed in".
A run holds the names of your users and what they cost. It is handled like that all the way.
If we do not hold it, it cannot leak from us.
No trackers, no analytics, no advertising, no third-party scripts or fonts.
Every page, this one included, may run only scripts and styles served by the portal itself, and cannot be framed by another site.
A sign-in to the portal lasts twelve hours at most. Roles decide who may change settings, set prices or end a plan: owner, operator or viewer.
Our own operator console answers only on the server's loopback address, over an SSH tunnel, and never through the public site. It shows counts, versions and the state of the service; it cannot open a run, read a finding or see a user's name.
Found a security problem? Write to security@glacierpointtech.com with the details, and what to do to see it. Please do not test against tenants or workspaces that are not yours. /.well-known/security.txt carries the same address.