Community project · Online test release
ConfigReview
ConfigReview was previously published as AdminSecOps. I’m building it to help Microsoft administrators understand configuration gaps, review the evidence and decide what to fix first.
Product walkthrough
See how ConfigReview turns evidence into actionable findings
This short walkthrough introduces the assessment experience, from reviewing coverage to understanding a finding and the evidence behind it. Use fictional data first, then review the permissions and limitations before connecting an authorised test tenant.
Why I’m building it
Make the evidence understandable
An administrator needs more than a list of warnings. Each finding should explain what was observed, why it matters, what to check before making a change, and how to verify and roll back that change.
The assessment engine uses deterministic controls. Missing or unauthorised evidence stays not assessed; it never becomes a passing result.
- Fixed read operationsNo automatic remediation.
- Visible coverageConnected, missing and unsupported sources remain distinguishable.
- Community sourceMIT-licensed code, tests and contribution guidance on GitHub.
- Independent projectNot affiliated with or endorsed by Microsoft or any current or former employer.
Online assessment
Connect through your browser
The online app reads Entra ID, Intune, SharePoint/OneDrive and limited Teams settings through Microsoft Graph. Azure uses a separate connection and consent. Exchange Online assessment is not enabled in the hosted service because its available connector requires a management-scoped permission.
Coverage depends on permissions, roles, licensing and successful collection. No live tenant has been validated in this release; connect an authorised test tenant, not production. On-premises collection and Teams tenant policies are not available online.
Understand where your data goes
The online service processes configuration on its server. Results are retained in the live database for 30 days and audit events for 90 days. Database backups may retain deleted records for up to seven additional days. Downloaded reports remain under your control.
Review consent before connecting an authorised test tenant. An assessment is not a penetration test, certification or guarantee of security.
Open source
Review the code before connecting
The source includes fictional examples and a local edition. The older browser-edition URL now redirects to this project page. Exchange Online and on-premises collection are available only in the local edition.
Help improve the project
I welcome reproducible defects, control corrections, accessibility improvements and clearer documentation. Use synthetic examples; never publish customer evidence, reports, identifiers or credentials.
Report security concerns privately using the repository’s security policy.