Sign up at https://app.cloudcapsule.io/. Enter your Tenant ID. Click here to find your tenant ID via your domain name. Consent to the permissions with a Global Admin in the tenant. Click on Start Assessment. Check out our Video Tutorial for more details.

CloudCapsule is optimized for use with Microsoft’s premium licensing to elevate security to the proper standard. For most SMB clients, Microsoft Business Premium is going to be the most optimal licensing choice given it has these key features: Entra ID P1, Intune, Defender. Microsoft M365 E3 and E5 licenses also provide optimal results but will also reflect additional complexity due to the expanded feature set found in these licenses. Please note that if you try to add a tenant with licensing with reduced features such as Business Standard, the assessment will fail given the lack of a Defender service principal.

Simply reach out to our team at support@cloudcapsule.io or use our Book a Demo link to schedule an appointment to discuss your specific needs. We offer volume pricing discounts and can scale to meet business with 10,000 seats or more with ease.

Our Essentials plan is available on a monthly or annual basis. Monthly plans can be cancelled at any time, annual plans can be cancelled upon completion of the 12-month subscription term.

The data privacy of a tenant is of utmost importance to our team, so please contact us if you have any questions or concerns about using CloudCapsule. In general, we primarily request read permissions to the tenant with a few read/write permissions to properly enable and disable access of our platform.

The full set of Microsoft Graph permissions CloudCapsule requests during consent is listed below. Each permission is requested for a specific assessment, remediation, or reporting capability.

Read-only permissions (used for assessment and reporting)

• Application.Read.All — Read all Enterprise Applications in the account.
• AuditLog.Read.All — Read all audit log data for sign-in information and suspicious user activity.
• DelegatedAdminRelationship.Read.All — Read Delegated Admin relationships with customers.
• DeviceManagementApps.Read.All — Read Microsoft Intune apps.
• DeviceManagementConfiguration.Read.All — Read Microsoft Intune device configuration and policies.
• DeviceManagementManagedDevices.Read.All — Read Microsoft Intune devices.
• DeviceManagementServiceConfig.Read.All — Read Microsoft Intune configuration.
• Directory.Read.All — Read directory data (specifically users and groups).
• GroupMember.Read.All — Read all group memberships.
• IdentityRiskEvent.Read.All — Read all identity risk event information.

Additional read-only permissions cover mailbox settings, organization branding, policies, sign-in reports, security alerts, security events, SharePoint and tenant settings, Teams and users, plus Defender data (alerts, machines, vulnerabilities, recommended actions):

• MailboxSettings.Read
• Organization.Read.All
• OrganizationalBranding.Read.All
• Policy.Read.All
• Reports.Read.All
• SecurityAlert.Read.All
• SecurityEvents.Read.All
• SharePointTenantSettings.Read.All
• Sites.Read.All
• Team.ReadBasic.All
• TeamSettings.Read.All
• User.Read.All
• UserAuthenticationMethod.Read.All
• Alert.Read.All
• Machine.Read.All
• Score.Read.All
• SecurityRecommendation.Read.All
• Software.Read.All
• Vulnerability.Read.All

Read/write permissions (used for remediation and managed app deployment)

• Application.ReadWrite.OwnedBy
• Policy.ReadWrite.AuthenticationMethod
• ReportSettings.ReadWrite.All
• RoleManagement.ReadWrite.Directory
• Exchange.ManageAsApp

OpenID Connect scopes (used to sign you in)

• email
• offline_access
• openid
• profile
• User.Read

If your team requires a detailed permissions audit, contact support@cloudcapsule.io and we can walk through each scope and the data it accesses.

The data privacy of a tenant is of utmost importance to our team, so please contact us if you have any questions or concerns about using CloudCapsule. All data is stored in cloud instance within a region that you selected upon sign up (US or EU). The data for each tenant is isolated in its own instance in the database. EU datacenter: The data is hosted in GCP: europe-west1 (Belgium). The data is not being stored in any other location but it is also being processed with an Azure function in a West Europe datacenter on the Microsoft side (Amsterdam/Netherlands). US datacenter: The data is hosted in GCP: East US. AU Regions (Sydney): The data is hosted in GCP austrailia-southeast1 (Sydney). All tenant data is encrypted at rest and in transit. The data is only retained for one year and can be deleted on demand by revoking access in CloudCapsule. Role based access control is enforced on database with row-level access control. All access is gated by MFA at restricted locations. Periodic Vulnerability scanning is performed on the database. The data is not aggregated or used to train a larger model.