What Pulse reads

Every permission is read-only. Pulse never changes a setting in your organization.

• Policy.Read.All: Conditional Access policies, Security Defaults, authentication method and authentication strength policies, and cross-tenant access settings.
• RoleManagement.Read.Directory: Who holds admin roles, and whether they are permanent or just-in-time.
• AuditLog.Read.All: Which MFA methods each account has registered, and, when you run a sign-in scan, the last 30 days of sign-in logs (through Microsoft's preview API).
• LicenseAssignment.Read.All: Which Microsoft licences your organization has, to tell what can be checked.
• Domain.Read.All: Your domains, and whether sign-in for any of them is handed to another identity provider.
• GroupMember.ReadBasic.All: Group membership, to work out who each policy covers (used from the per-user coverage check).
• Application.Read.All: Apps connected to your organization and their permissions (used from the Third-party access checks).
• User.Read (at sign-in): Your name, and your organization's name and default domain.

What Pulse stores

Your Microsoft tenant ID, your organization's name and default domain, whether access was granted, when and by which administrator account (its directory ID), and when your report was last run. Your report is read live each time you open it; Pulse does not store Microsoft access tokens. Your sign-in is kept in a cookie in your browser.

If you share a report, Pulse keeps a copy of that report as shown (score, category and signal results, findings and likely underwriter requests), your organization's name, a report ID, and the dates involved. Account names in findings are replaced with "Admin account 1" and so on, unless you choose to include them when you create the link. For each link it keeps a one-way hash of the link, the directory ID of the administrator who created it, any label you typed, its expiry and revocation dates, how many times it was opened, when it was last opened, and how many times the "Learn more" link was clicked. Pulse does not record who opened a link: no IP addresses, no cookies, no third-party trackers. Shared copies are deleted 30 days after their link expires or is revoked.

If you run a sign-in scan, Pulse reads the last 30 days of sign-ins and keeps only the totals and the accounts its findings name: the name and sign-in name of each account that signed in with a password alone or through legacy authentication, how many times, and which legacy clients. It never stores the sign-in records themselves. While a scan is running it keeps per-account counts so it can resume; they are cleared when it finishes. Only the latest scan is kept: starting a new one replaces it.

Our hosting provider's request logs include visitor IP addresses and page addresses.

How to remove access

To remove Pulse's access at any time: in the Microsoft Entra admin center, go to Entra ID > Enterprise apps > All applications, open Pulse, then choose Properties > Delete. This removes the consent, and Pulse can no longer read your tenant within about an hour.

Removing access does not delete what Pulse has already stored. Links you have shared keep working until they expire or you revoke them.