TenantWatch audits Microsoft 365 and Google Workspace security settings, read-only, and reports what gets small organisations breached.

Features

• Configuration checks: accounts without MFA, over-permissioned third-party apps, mailboxes auto-forwarding outside the org, admin sprawl, “anyone with the link” sharing, spoofable domains
• Sign-in Watch (v0.2): reads 7 days of sign-in activity — legacy auth that SUCCEEDED, admin password-only sign-in, password spray that landed (Critical); impossible travel (High); provider-flagged suspicious sign-ins. No learning period
• Findings prioritised and self-resolving

Read before you buy. Sign-in watch on M365 needs Entra ID P1/P2 (Business Premium, NOT Basic/Standard); without it those checks stay silent and say why. Google reports no country and no per-event auth strength, so two checks cannot run.

Server

• Linux x86-64; static binary or Docker
• ~10 MB binary, ~10 MB RAM idle, SQLite (no DB server)
• Minimum host: 1 vCPU, 512 MB RAM, 200 MB disk
• Dashboard 127.0.0.1:8430; outbound only to Microsoft Graph / Google APIs, read-only

Tiers. Free: 1 tenant (GitHub). Pro and Team: more tenants, alerts, multi-user. 14-day trial.

Wazuh/Splunk-ready, every tier: file, syslog JSON/CEF, Splunk HEC; free Wazuh rules + Splunk add-on on GitHub.

AI Assist (optional, offline): explains any finding on your hardware; the engine decides.

Whop sells paid licences only. Free: github.com/nizartuanku/tenantwatch