Microsoft 365,
under control.
One workspace to See, Manage, Audit, Assess, Optimize, and Detect. Inventory, management, audit history, posture scoring, and detection in one console. Run it on a workstation or self-host it for the whole team — tenant data never leaves your walls.
30-day full-feature trial · Community Edition free forever · No credit card
Tenant overview
Contoso (synthetic) · Synced today 07:00
Users
1,420 objects · local Community| User | Department | Licence | Status |
|---|---|---|---|
| [email protected] | Finance | M365 E3 | Active |
| [email protected] | Engineering | M365 E5 | Active |
| [email protected] | Sales | M365 E3 | Inactive |
| [email protected] | Operations | F3 | Active |
| svc-backup | IT | E3 | Service |
Audit activity
Last 24 hours · unlimited retention
Compliance posture
CIS M365 + SCuBA baselines · 123 passed · 22 to review
Licence & cost insights
Value-added findings · refreshed daily
- Cost 38 E3 licences, no sign-in in 90+ daysabout $16k a year at list price
- Save 12 mailboxes over 50 GB on basic plansarchive policies unused
- Med 9 guests with no access reviewoldest invited 18 months ago
- Info Posture score B+ · 22 checks to reviewCIS M365 baseline coverage
Threat Center
MITRE-mapped detections · synthetic data
- High 2 apps hold Mail.ReadWrite.Allone consented by a non-admin
- High 1 inbox rule forwards invoices externallycreated 14:28 UTC, 2 days ago
- Med 3 Global Admins, no sign-in in 90+ daysincl. 1 break-glass account
- Info "Require MFA for admins" modifiedexclusion added by j.patel
It stays on your machine
Your tenant's settings and audit logs are read onto your own computer and stay there. We never see them.
Checks you can read
Every check shows you the rule behind it, where it came from, and whether it passed — no black box, no score you can't explain.
Proof you can hand over
Turn any finding into a report an auditor will accept — PDF, Excel, HTML or CSV, generated on your machine.
Fast, because it's local
Once your data is collected, searching it doesn't wait on Microsoft's APIs. It's already on your disk.
Community Edition
See it. Manage it. Audit it. Get alerted. Free.
Community Edition brings the daily essentials together in one local workspace. No user limit, no expiry, no retention cap on what you collect. Upgrade for posture and compliance baselines, licence optimization, automation at scale and security response. Every install starts with 30 days of all features.
Reporting & Insights
Every report, dashboard and licence view your tenant can produce — no scripts, no export ceiling.
Management
Every admin action — users, groups, mailboxes, quarantine, MFA, offboarding, app consent — from one workspace.
Auditing
Collect and search activity across Entra, Exchange, SharePoint and Teams — kept as long as you have disk.
Event Alerting
Custom alert rules on collected activity, delivered to email or Teams.
Community: reporting, management, auditing and alerting, free forever
- Full tenant inventory — users, admins, guests, groups, Teams, sites, mailboxes, licences, apps
- Every interactive management action — MFA and Temporary Access Pass, just-in-time elevation, offboarding, app consent, mailbox and quarantine operations
- Bulk user import from CSV
- Audit collection and search across Entra, Exchange, SharePoint, Teams and DLP — unlimited local retention
- Custom event alert rules with email and Teams notifications
- Scheduled collections and scheduled report delivery
- Every export format — CSV, HTML, Excel and PDF
- Breach-exposure checks on tenant accounts (Have I Been Pwned, your own key)
- Role-based delegation
- One tenant and one operator — extra seats as a small add-on
Pro and Defend: assess, automate, investigate
- Licence and cost optimization, posture analysis and executive-ready summaries
- CIS Microsoft 365 and CISA SCuBA baselines — findings, drift trends and history
- Automated playbooks and remediation, approval queues and policy guardrails
- Work queues and cross-tenant operations — unlimited tenants and operators
- White-label — your logo, colours and name on the app, reports and emails
- Audit compaction and rollups for very large archives
- Threat detection, investigation and supervised response (Defend)
- Nothing is deleted when the trial ends
- The paid features switch off. Everything you collected stays on your disk and stays readable.
- Room for the whole team
- Community includes one operator, and extra seats are $49/year each. Pro and Defend include unlimited operators — we charge for the size of the estate, not the number of people looking at it.
- Not your data for our product
- There is no telemetry and no vendor cloud holding your tenant data. Free means free.
How the free tier compares
Vendors' own published information, September 2026.
| Capability | SysClaw Community | AdminDroid Free | ManageEngine Free | CoreView |
|---|---|---|---|---|
| User limit | None | None (Entra reports) | 25 users | No free tier |
| Management tasks | Included | See vendor | Included, 25 users | — |
| Audit log collection | Included, unlimited retention | Entra only; packs paid | Professional only | — |
| Posture vs CISA SCuBA and M365 baseline | Pro | — | — | — |
| Runs where | Your desktop | Your server | Your Windows server | Vendor cloud |
Get notified when SysClaw launches
Installers for Windows, macOS and Linux are in final packaging. Leave your work email and we will send you the download the day it ships — plus the founding-customer offer.
You're on the list
We will email you the moment the SysClaw installers and the live demonstration tenant are ready.
What it finds
The things nobody goes looking for.
Not another dashboard of counts. These are the findings that come out of a first collection — the ones that normally take a weekend of PowerShell and six browser tabs to assemble. Every install includes a 30-day trial of all features. Availability after the trial follows the edition comparison below.
Which OAuth applications hold risky permissions?
Every OAuth grant and service principal, the Graph scopes it holds, who consented, and what it can reach. High-privilege third-party apps are the exfiltration path most tenants never audit.
Is mail being forwarded outside the tenant?
Inbox forwarding rules, Exchange connectors and journaling configuration that send mail outside the tenant — the first thing to check after a compromise, and the easiest to miss.
Which privileged accounts are risky or dormant?
Privileged role assignments ranked by last sign-in, so dormant global admins and stale break-glass accounts surface before an attacker finds them.
Which guest users still have access?
External accounts still present in the directory, Teams and groups long after the project ended, ready for an administrator to review.
Is legacy authentication still being used?
Basic-auth sign-ins, MFA registration gaps, Conditional Access coverage holes and app credential changes — the identity weaknesses baselines are written to catch.
Which licences are assigned but underused?
Every assigned licence against the last sign-in behind it, so seats held by leavers, service accounts and duplicates show up as a number your finance team recognises, before renewal.
Every finding is evidence-backed: the rule that produced it, the records it matched, and the remediation guidance — exportable to PDF, Excel, HTML or CSV.
The problem
Answer "what changed, who did it, and are we still secure?" without opening six portals.
Right now, checking one user means jumping between half a dozen admin centres and stitching the answer together yourself. SysClaw puts it in one place.
Fragmented Microsoft 365 Admin Portals
Administrators and security leads must bounce between Entra ID, Exchange, SharePoint, Teams, and Defender admin centers to verify basic settings, permissions, and guest hygiene.
One searchable list of your users, admins, apps, mailbox permissions and guests.
Point-in-Time Audits & Undetected Drift
Annual or quarterly compliance reviews create a temporary illusion of security. Routine tenant administration creates silent configuration drift that weakens posture over time.
Run the same checks whenever you like and compare against last time, so a change never goes unnoticed for a quarter.
Disconnected Investigation Workflows
When anomalous behavior occurs (e.g., suspicious mail forwarding or OAuth consent grant), analysts must correlate audit logs, user context, and blast radius manually.
One place that puts the events in order, explains what the attacker was doing, and suggests how to shut it down.
Manual Evidence Production & Spreadsheet Hell
Compliance teams spend weeks capturing screenshots, exporting CSVs from disparate consoles, and stitching together spreadsheets to satisfy internal and external auditors.
Evidence an auditor will accept, in one click — with the rule behind every finding shown.
Access model
What SysClaw asks for — and what it doesn't.
The fair question to ask any tool that wants into your tenant. Most Microsoft 365 tools require a standing global admin account or a vendor's multi-tenant application with permanent access. SysClaw is built the other way round.
What it asks for
Delegated permissions, scoped to you
SysClaw acts as the admin who signed in. It can read what your own role already permits and nothing more — it never holds access you do not.
No standing service account
There is no permanent global admin identity left behind in your tenant for SysClaw to use. Nothing keeps working after you revoke access.
Read-first for assessment
Posture evaluation, inventory and audit collection need read scopes only. Write scopes are used for management actions you explicitly perform.
Credentials encrypted on your disk
Tokens and secrets are stored locally with AES-256-GCM under a key you control — not in a vendor keystore.
What it never does
- No tenant data sent to a SysClaw cloud — there is no such cloud
- No telemetry, analytics beacon or crash reporting
- No licence phone-home; activation is validated locally and works offline
- No standing multi-tenant vendor application in your directory
What's inside
One local workspace for administration, evidence and security.
Reporting, management, auditing and event alerting are free in Community — every export format and every schedule included. Paid editions add insight reports, compliance baselines, automation, white-label, multi-tenant scale, detection and response.
Inventory & reporting
Users, groups, roles, guests, Teams, sites, mailboxes, apps and licences — searchable from one local workspace.
Microsoft 365 management
Every interactive admin action — users, groups, mailboxes, quarantine, MFA and TAP, just-in-time elevation, offboarding, app consent — plus bulk CSV import.
Licence optimization
Find dormant, disabled and underused assignments, model savings, allocate cost and prepare for renewal.
Audit & evidence
Collect and search Entra, Exchange, SharePoint, Teams and DLP activity locally with unlimited retention, then build exportable evidence.
Event alerting
Custom rules over collected activity, delivered to email or Teams — no paid subscription required.
Posture & drift
Evaluate versioned M365 and CISA SCuBA baselines, inspect evidence and compare configuration over time.
Automation & playbooks
Run governed playbooks with templates, approval queues, schedules, guardrails and an auditable run history.
Detection & response
Correlate incidents, investigate timelines and blast radius, tune watchlists and approve containment actions.
Multi-tenant operations & delegation
Connect unlimited tenants, check provisioning and account health, and work queues across clients — with unlimited operators.
White-label
Your logo, colours and product name across the app, reports, email headers and the sign-in screen — no "Powered by" attribution.
How it works
Four steps, from first scan to fixing what you find.
You stay in control at every step. Nothing is collected, changed or acted on without you deciding it should be.
Pull your tenant into one place
SysClaw signs in as you and reads your settings, users, and activity logs onto your machine. It can only see what your own account can see.
See how you're doing
Your tenant is measured against the M365 and CISA SCuBA security baselines. You get a score, a list of what failed, and why it matters.
Work out what happened
When something looks wrong, SysClaw puts the events in order: who did what, when, from where, and what they could reach.
Fix it, or prove it's fixed
Export the evidence for an auditor, or shut down a compromised account — disable it, sign it out, revoke the app it approved. You approve every action.
Product Tour
The product, organized around the work you do.
Everything here runs against data already sitting on your machine.
Everyone and everything, in one local workspace
Search users, groups, admin roles, mailboxes, applications and permissions instantly because the collected data is local.
- Filter by admin role, MFA status or unused licence
- Review guests, role assignments and application access
- See which outside apps hold sweeping permissions
| User / Principal | Assigned Roles | MFA Method | Status |
|---|---|---|---|
| Adele Vance | Global Administrator | FIDO2 / MS Auth | Compliant |
| Service_GraphIngest | Service Principal | Certificate (2048) | Active |
| [email protected] | Guest User | SMS (Legacy) | Review Due |
Baseline Coverage & Methodology
We tell you what we can't check, too.
Plenty of tools claim full coverage. Some checks genuinely can't be automated — Microsoft doesn't expose the data. We label those instead of quietly passing them.
| Baseline Framework | Benchmark Version | Target Workloads | Evaluation Mode | Last Validated |
|---|---|---|---|---|
| SysClaw M365 Security Baseline Standard & Strict configuration profiles | v1.0 | Entra ID, Exchange, SharePoint, Teams, Defender | Automated & Partial checks | August 2026 |
| CISA SCuBA Baseline Secure Cloud Business Applications for M365 | Current | Entra ID, Exchange, Defender, Power Platform | 47 Automated / 5 Manual | August 2026 |
| Maester Community Tests Community-driven Microsoft 365 security test suite | v0.9.x | Conditional Access, App Registrations, Intune | Automated Checks | August 2026 |
| ORCA Exchange Online Office 365 Recommended Configuration Analyzer | v2.3 | Exchange Online Anti-Spam, Anti-Phish, Safe Links | Partial via PSG | August 2026 |
Security & Architecture
Your tenant data belongs to you. So it stays with you.
Most security tools copy your whole directory and activity history into their cloud. SysClaw doesn't have a cloud to copy it into.
It never leaves the building
SysClaw talks to Microsoft directly from your own machine — there's no middleman server in between.
The safeguards
Only the access you already have
SysClaw acts as the admin who signed in — it can't see anything you couldn't see yourself. Checking your posture needs read access only.
Keys kept locked
Any secrets or tokens are encrypted on your disk with a key you control.
This website knows nothing
This site is completely separate from the product. It never asks for, or receives, anything about your tenant.
Who it's for
The people who get called when something looks wrong.
Whether you run the tenant day to day, sign off the audit, or handle the incident.
Microsoft 365 Administrators
Eliminate portal switching with centralized inventory across Entra ID, Exchange, Teams, and SharePoint. Automatically catch unauthorized configuration changes.
- ✓ Unified directory & policy queries
- ✓ Configuration drift notifications
- ✓ License & guest hygiene insights
Security Leads & SOC Managers
Maintain defensible tenant posture visibility, triage MITRE-mapped detections, eliminate alert fatigue through custom watchlists, and supervise containment playbooks.
- ✓ MITRE ATT&CK detection catalog
- ✓ Watchlists & suppression rules
- ✓ Session timeline reconstruction
Compliance & GRC Practitioners
Replace manual screenshot evidence with deterministic baseline scans against the SysClaw M365 Security Baseline and CISA SCuBA. Generate executive audit packages in minutes.
- ✓ Versioned security baseline mapping
- ✓ Historical pass/fail trend tracking
- ✓ Local PDF/Excel/HTML exports
Frequently Asked Questions
Direct answers to technical and operational questions.
Factual information for security evaluators, compliance practitioners, and administrators.
What is SysClaw?
SysClaw is a desktop app for Microsoft 365 management, inventory, auditing, posture assessment (M365 Security Baseline & CISA SCuBA), and threat detection. It runs on your own machine, connects to your tenant with delegated sign-in, and keeps everything it collects on that machine. Community Edition includes reporting and insights, every management action, auditing with unlimited local retention, event alerting, all scheduling and every export format — free with no user limit. Pro adds licence optimization, compliance baselines, automation, white-label and unlimited tenants; Defend adds threat detection, investigation and supervised response.
Is there a trial, and what happens when it ends?
Every install starts with a 30-day trial of every feature, with no credit card. When it ends the application becomes Community Edition: the paid features switch off, and everything you collected stays on your disk and stays readable — Community audit retention is unlimited.
Is there a cloud version?
Not yet. SysClaw Desktop is the shipping edition. SysClaw Cloud is planned; until it ships, nothing on this site should be read as describing a hosted service.
Is SysClaw a cloud service or a local-first application?
SysClaw is a desktop, local-first application. It connects directly from the operator's machine or private virtual host to Microsoft 365 tenant APIs. All data normalization, rule evaluation, incident correlation, and reporting execute locally.
Does Microsoft 365 tenant data leave the machine running SysClaw?
No. Tenant configurations, directory objects, sign-in logs, and assessment outputs remain entirely on your local machine. SysClaw does not transmit tenant data or audit records to an external SaaS backend or third-party cloud data lake.
Can SysClaw assess a tenant against the M365 Security Baseline or CISA SCuBA guidance?
Yes. SysClaw includes built-in baseline mappings for the SysClaw M365 Security Baseline (Standard and Strict profiles) and CISA SCuBA. Each check clearly specifies whether its evaluation is automated, partial, or manual.
Does SysClaw certify that a Microsoft 365 tenant is compliant?
No. SysClaw evaluates technical configuration against published baseline recommendations. It does not certify regulatory compliance or substitute for an accredited third-party audit.
Does SysClaw support Microsoft 365 threat detection and incident investigation?
Yes. SysClaw includes a dedicated detection engine mapped to the MITRE ATT&CK framework. It flags anomalous events such as suspicious inbox forwarding rules, dormant admin activations, and high-risk OAuth grants, grouping related events into an investigative incident workbench with chronological session timelines.
Which permissions and Microsoft licenses are required?
SysClaw requires an Entra App Registration with Microsoft Graph delegated permissions scoped to the signed-in administrator's role. Certain advanced audit visibility and Conditional Access checks require standard Microsoft 365 E3/E5 or Entra ID P1/P2 licenses within the target tenant.
Is SysClaw really free? What's the catch?
There is no catch, no expiry and no user limit. Community Edition includes reporting and insights, every management action, auditing with unlimited local retention, custom event alert rules, all scheduling and every export format — for one tenant. We charge for licence optimization, posture and compliance baselines, automation at scale, white-label, unlimited tenants and operators, and the Defend threat-detection layer.
How is SysClaw different from Maester, ScubaGear and Microsoft Secure Score?
Maester and ScubaGear are excellent free PowerShell tools that give you pass/fail results for one run; Secure Score gives a point-in-time score with generic recommendations. SysClaw covers the M365 Security Baseline and CISA SCuBA in one desktop app with no scripting, and on paid tiers stores every assessment so you can see what drifted and when. Community includes local audit visibility and event alerting; Defend adds threat detection and investigation.
Be there at launch — or talk to us about Pro.
SysClaw is in final packaging — leave your email on the launch list and you get the download the day it ships. Every install starts with 30 days of every feature, then stays free forever with no user limit — no credit card, no demo required. If you would rather see it first, schedule a 30-minute walkthrough with a SysClaw engineer for Pro or Defend.
Pro demo includes:
Demo Request Received
Thank you for your interest in SysClaw. Our security engineering team will review your request and contact you within one business day to coordinate your technical demonstration.