Documentation
How TRACER365 works
The parts worth reading before you install anything: the auth model, the permissions it requests — and refuses — and what a scan actually does.
The basics
What you're installing
TRACER365 runs as a background Windows service on a machine you control, and serves its management interface over HTTPS as a web console listening on a TCP port on the host; how that port is reached is determined by your own network configuration, and it needs no inbound path from the internet. There is no SaaS backend — the app talks directly to Microsoft's APIs from your environment, and everything it finds is stored locally.
At a high level, you'll need:
- a Windows machine to install on — Windows Server 2019 or later, or Windows 11 (a laptop is fine — consultants run it that way);
- permission to create an app registration in the Microsoft Entra tenant you're auditing, and an admin who can grant consent to its read-only permissions;
- outbound access to Microsoft Graph and SharePoint Online endpoints.
No agents, no tenant footprint
Per-installation licence
Trial: 30 days, no registration
Security model
Read-only, certificate-based, verifiable
TRACER365 authenticates to Microsoft Graph and the SharePoint API using certificate-based, app-only authentication — the modern Microsoft-recommended pattern. App-only means there is no signed-in user and no delegated permissions at all: the app can never do anything on a user's behalf.
The certificate is yours: generated on your own machine (a helper script ships with the product), uploaded by your admin to your app registration. Storrex never holds, escrows, or can recover it — each installation is a fully isolated credential unit, and no credential spans customers.
Because the app registration lives in your tenant, your security team can open it at any time and verify the permission list below — and that nothing on it can write.
One posture decision worth knowing: Microsoft offers a faster sharing-change feed, but gates it behind tenant-wide full control permission. TRACER365 declined it. In the product's own words to security reviewers: we'd rather accept a bounded delay on one optimisation than ask for write access to your tenant.
Application permissions requested (all read-only)
| Permission | Used for |
|---|---|
Files.Read.All | Read files and their permissions for the sharing analysis |
Sites.Read.All | Enumerate SharePoint sites and read site-level metadata |
User.Read.All | Resolve who a finding points at (display names, sign-in names) |
Group.Read.All | Enumerate Microsoft 365 groups and map sites to their backing group |
Sites.Read.All (SharePoint API) | Read site permission groups so routine site groups can be filtered as noise |
The full security & trust page goes further — credentials at rest, the operator roles, the audit trail, framework alignment, and an explicit list of what the product deliberately doesn't do.
Scanning
How a scan works
01 — Enumerate
Every SharePoint site and every OneDrive in the tenant — including the sites behind Teams channels. Anything that can't be enumerated (a OneDrive under retention lock, say) is listed with its reason, never skipped silently.
02 — Analyse, read-only
Permissions and sharing links on every item are read and classified into nine severity-ranked finding types — external exposure first, from anonymous "Anyone" links to inherited guest access.
03 — De-duplicate
Inherited duplicates collapse under the grant that caused them — in our testing, roughly 91% of raw findings collapsed as duplicates. You watch progress live the whole way.
04 — Repeat on schedule
Scheduled scans keep the answer current: expanded sharing re-flags for review, reduced sharing doesn't nag, and scan-over-scan history feeds the trend view and email reports.
The full capability tour — what's detected, what's out of scope, and the honesty section — is on the product page.
Common questions
Does it change anything in my tenant?
What Microsoft licence do I need?
Where does my audit data live?
When can I install it?
This documentation is deliberately partial. It expands as we approach launch (autumn 2026) — install guide, certificate setup, scanning model reference, and troubleshooting land here as they're finalised. Questions in the meantime: support.
Ready to see it on your own tenant?
30-day free trial at launch, no registration — get notified the day the installer ships.