Privacy
Last updated 27 August 2026
Shield reads Microsoft 365 configuration and usage metadata so an organisation can report on its own governance posture. It holds no write permission of any kind, and it does not read the contents of files, messages or mailboxes.
Who operates this service
Shield is operated by ATRONTECH CONSULTANTS LLP, trading as Atronova. Enquiries about this notice, or any request concerning data held about you, should go to privacy@atronova.com.
What is read from a connected tenant
Access is granted by an administrator of your organisation through Microsoft’s admin consent, and can be withdrawn by them at any time in the Azure portal without our involvement. Every permission requested is a read role:
| Permission | What it is used for |
|---|---|
| Organization.Read.All | Read your tenant name, domains and licence counts so reports can be labelled. |
| Directory.Read.All | Read users, groups and directory objects to attribute every site and mailbox. |
| Reports.Read.All | Read the Microsoft 365 usage reports that provide site storage, mailbox size and activity data. |
| Sites.Read.All | Read SharePoint site metadata and permissions to build the sharing and access reports. |
| Group.Read.All | Read Microsoft 365 groups, distribution lists and their owners. |
| AuditLog.Read.All | Read directory audit and sign-in logs for the audit evidence pack. |
| RoleManagement.Read.Directory | Read who holds privileged admin roles such as Global and Exchange Administrator. |
| Policy.Read.All | Read Conditional Access and external collaboration policy for posture reporting. |
| SharePointTenantSettings.Read.All | Read tenant-level SharePoint sharing configuration. |
| SecurityEvents.Read.All | Read Microsoft Secure Score and its control breakdown. |
| Application.Read.All | Read registered and consented third-party applications and their granted permissions. |
| ReportSettings.Read.All | Detect whether usage reports are anonymising user names, which would break owner attribution. |
| InformationProtectionPolicy.Read.All | Read the sensitivity label taxonomy published to your tenant. |
| SecurityAlert.Read.All | Read Microsoft Defender alerts so security posture reporting reflects live detections. |
| SecurityIncident.Read.All | Read Defender incidents, which group related alerts into a single investigation. |
| DeviceManagementManagedDevices.Read.All | Read enrolled devices from Microsoft Intune: platform, ownership, encryption and compliance state. |
| DeviceManagementConfiguration.Read.All | Read Intune compliance policies and configuration profiles, and how many devices each covers. |
| DeviceManagementApps.Read.All | Read Intune app protection policies, which keep work data inside managed apps on phones that are not enrolled. |
| MailboxSettings.Read | Read mailbox inbox rules to detect auto-forwarding to external addresses. Enumerates every mailbox, so it is off by default. |
| Exchange.ManageAsApp | Read Exchange Online protection configuration — anti-spam, anti-phishing, DKIM, forwarding and transport rules — for the Exchange baseline score. Shield runs Get- cmdlets only, and also needs the read-only Global Reader role assigned to its enterprise application. |
| Machine.Read.All | Read Microsoft Defender for Endpoint device state — onboarding, sensor health, antivirus mode and update status, risk and exposure — for the Defender baseline score. Read-only: it cannot isolate, scan or change a device. |
| Score.Read.All | Read Microsoft’s own exposure score and Secure Score for Devices, shown alongside the Defender baseline. |
What Shield does not do
- It cannot alter a permission, delete content, or change any setting in your tenant.
- It does not read the body or attachments of any email, document or message.
- It does not send mail as anyone in your organisation.
- It does not sell, rent or share tenant data with third parties.
- It does not use your tenant data to train machine-learning models.
What is stored, and where
Report results, the exceptions raised from them, and the figures behind the trend charts are stored so that comparison over time is possible at all. Microsoft’s own usage reports retain 180 days; keeping our own copies is what allows a year-on-year answer.
All data is held in Microsoft Azure in Central India, encrypted at rest and in transit. The database accepts connections only from the application itself.
How long it is kept
| Data | Retention |
|---|---|
| Report results and rows | 400 days by default, configurable per organisation |
| Trend figures | 3 years — small, and the reason year-on-year comparison works |
| Our own audit log of who did what in Shield | 2 years |
| Sign-in sessions | 12 hours |
| Generated workbooks | 90 days |
Disconnecting a tenant stops all collection immediately. Deleting an organisation removes its data, including every report result and finding.
Who can see it
Only members of your own organisation in Shield, subject to the role they hold. Data from one tenant is never visible to another. Atronova staff access production data only where necessary to operate or support the service, and such access is logged.
Sub-processors
Microsoft Azure hosts the application, its database and its file storage, and Azure Communication Services delivers scheduled report emails. Both operate under Microsoft’s terms in the region stated above.
Your rights
You may ask what data is held about you, request its correction or deletion, or request an export. Write to privacy@atronova.com and we will respond within 30 days. A tenant administrator can also revoke Shield’s access directly in Microsoft Entra ID at any time, which stops all further collection without needing to contact us.
Changes
Material changes to this notice will be announced in the application before they take effect. The date at the top always reflects the current version.