Read-only, every day, in plain English.

Four steps

1
Connect, read-only. Your administrator approves a read-only Agentscopic app in your Microsoft Entra ID tenant. It signs in with a certificate, holds no secrets, and can be reviewed or removed at any time.
2
Add your identity governance and privileged access data. Exports from SailPoint, Saviynt or CyberArk are encrypted on your own server before they leave it. Only your organisation's partition can open them.
3
Compare and check. Every day Assay reads Entra ID, compares it with your exports, and runs its identity, agent and Microsoft 365 checks, including the open-source Maester checks.
4
Read the digest. The people you name receive a plain-English digest: what changed, the most serious findings, who should act and how. Accepted risks are listed separately with their end dates.

Each customer has its own encrypted partition on Agentscopic's runner, with its own account and certificate.
Your exports are only decrypted in memory during a run.
Runs, encrypted files and digests are kept for 180 days by default and then deleted. If your auditor needs a longer history, or your policy a shorter one, we agree the period in your contract.
No AI model writes your findings. Every explanation is fixed text.

It never changes anything in your tenant. Fixing a finding is up to your team.
It does not yet check SharePoint and OneDrive sharing, Azure resources, mailboxes, Active Directory or devices. The digest lists these as "not checked".
It is run for you by Agentscopic. It is not installed in your Azure subscription.