TenantSee the whole picture
Identity, device, policy and service health signals in one place.
OPEN SOURCE · SELF HOSTED · MIT
Your tenants.
One clear view.
A calmer way to keep watch over Microsoft 365. Bring identity risk, devices, access policies and alerts together in a dashboard you control.
Microsoft 365 today. A wider security view tomorrow.
◇ tenantwarden / overview Monitoring
◇▦◉▤⚙
SECURITY OVERVIEWGood morning, team ✳
Last 24 hours⌄Your tenant signals, all in one place.
CONNECTED TENANTS04● All connected
ACTIVE ALERTS12↗ 3 need attention
SECURITY SCORE78%↗ 6 points this month
Security posture ⋯
MONTUEWEDTHUFRISATSUN
Live signals
Risky sign-inIdentity · ContosoNow
Device complianceIntune · Fabrikam12m
Policy updatedAccess · Northwind1h
BUILT AROUND THE SIGNALS YOU ALREADY USE
Microsoft GraphEntra IDIntuneConditional AccessSecure Score
THE MISSIONMake security context
Make security context
belong to the operator.
TenantWarden exists to turn scattered Microsoft 365 signals into a shared, actionable picture. Teams responsible for several tenants need to know what changed, why it matters and who should respond without rebuilding that context in every portal.
Self hosting and open source code let teams inspect the collection logic, run it on their own infrastructure and shape workflows around their needs. Microsoft Graph remains the source for Microsoft 365 data; TenantWarden reduces dependence on a single vendor dashboard or hosted monitoring service.
01 / THE IDEALess tab switching.
Less tab switching.
More signal.
TenantWarden collects Microsoft 365 data on a schedule or on demand, then helps you see what needs attention across tenants.
Act on alerts
Acknowledge, assign and resolve alerts with a clear status workflow.
Keep it yours
Run it with Docker Compose on infrastructure you control.
WHY IT MATTERSFrom portal hopping
From portal hopping
to a working picture.
Native portals are valuable sources of truth. The operational gap appears when a team must connect their signals across tenants and keep a response moving.
TRADITIONAL PORTAL WORKFLOW
Find the data. Rebuild the context.
- Open separate views for identity, devices, policies and health.
- Repeat the same checks in each tenant.
- Carry findings into separate notes and ticket queues.
TENANTWARDEN APPROACH
Keep the context together.
- Collect supported signals into one self hosted view.
- See tenant scoped alerts and posture history.
- Assign, acknowledge and track work where findings are reviewed.
TenantWarden complements the Microsoft admin portals and relies on their APIs for current Microsoft 365 data.
02 / WHAT IT WATCHESImportant signals,
Important signals,
within reach.
The current Microsoft 365 integrations help you investigate security posture without jumping between portals.
Identity risk
Risky users, sign-ins and authentication methods.
ENTRA IDDevice compliance
Intune managed device status alongside tenant risk.
INTUNEAccess policies
Conditional Access policy visibility across tenants.
CONDITIONAL ACCESSScores & health
Secure Score, service health and compliance trends.
SECURITY POSTURENotifications
Email, Teams, Slack, webhooks and PagerDuty channels.
WORKFLOWSEndpoint agent
A cross platform agent for host telemetry.
ENDPOINTS03 / THE DIRECTIONOne platform.
One platform.
A broader horizon.
TenantWarden starts with Microsoft 365. The longer term vision is to extend the same clear view across other environments.
AWS, Google Cloud and on premises support are future aspirations, not available integrations today.
AVAILABLE NOW
↗Microsoft 365
Graph based collection, alerts and security dashboard.
FUTURE VISION
↗AWS
Cloud security signals in the same view.
FUTURE VISION
↗Google Cloud
Another cloud, one consistent workflow.
FUTURE VISION
↗On premises
Connect security signals closer to home.
AI / FUTURE DIRECTIONLess noise.
Less noise.
Better questions.
AI could help an operator make sense of a busy alert stream: summarize a finding, connect related signals, explain a posture change and draft a weekly brief with links back to evidence.
That would make investigation faster while keeping a human responsible for decisions and remediation. Model choice and data handling should remain under the deployer's control.
AI insights are proposed work in the project task list. They are not a shipped TenantWarden capability.
Summarize what changed
Turn several related events into a short, evidence linked explanation.
Connect the signals
Surface the tenant, identity, device and policy context around an alert.
Suggest the next check
Draft investigation steps for review, with people retaining control.
04 / GET STARTED
Run it your way.
Clone the source, generate local secrets, build and start the Docker Compose stack. The repository has the full setup and Graph permissions.
DOCKER COMPOSE QUICKSTARTFull guide ↗
git clone https://github.com/jahmed-cloud/TenantWarden.git
cd TenantWarden
make setup-env
make certs
make build
make upⓘ TenantWarden is under active development. Its README currently recommends a private network or VPN deployment. Review the security audit before use.
05 / OPEN BY DESIGNMade in the open.
Made in the open.
Built to be yours.
TenantWarden is an MIT licensed project created and maintained by Junaid Ahmed, a cloud security and identity architect focused on Entra ID, Zero Trust and Azure governance.
The code, roadmap and current status are public. Explore the repository, raise an issue or contribute a change.
MORE TOOLS BY JUNAIDChoose a problem.
Choose a problem.
Explore a project.
Security, governance and useful infrastructure tools, each with a public repository you can open and explore.
IDENTITY SECURITY
EntraGuard
Assess Microsoft Entra ID posture with security checks, findings and remediation guidance.
Explore project ↗ AZURE GOVERNANCEAzure Resource Guardian
Find governance gaps and cost opportunities across Azure resources and subscriptions.
Explore project ↗ POLICY AS CODEAZPaC
Manage Azure Policy through reviewed Terraform files, with controlled enforcement and expiring exemptions.
Explore project ↗ SELF HOSTED INFRASTRUCTUREOpenPrint Server
Run a Docker based CUPS print server with queue and job controls for Linux and Raspberry Pi.
Explore project ↗Keep watch with
confidence.
Explore the source, read the setup guide and follow what comes next.
The guided template creates an Ubuntu VM and runs the Docker setup. Choose a subscription, SSH key and allowed IP, then verify the app startup. Access it through an SSH tunnel and connect Microsoft Graph afterward. Azure charges apply.