Saxalar watches every Microsoft 365 tenant you manage — continuously. It catches the change the instant it happens, scores your posture daily, turns license waste into savings, and puts an AI analyst on every finding so your team moves from signal to action.
Twelve operating surfaces, one console. Every surface is designed around what M365 admins actually do at 9:15am on a Monday — not a marketing diagram.
Users, groups, directory roles, PIM eligibility, apps and service principals, credentials, devices, admin units, GDAP relationships — 46 Graph collectors, searchable from any screen.
cmd-k everywhereProperty-level before-and-after for every monitored entity. Incremental delta sync means changes land in seconds — not overnight.
before → after53 detectors across the categories that cause incidents. Every finding carries lifecycle, suppression, related findings, and a 30-day trend — with the exact change event attached.
53 detectors · acknowledge → resolveOne number per tenant, tracked daily across Identity, Access, Data, and Compliance. History, pulse, posture controls against a baseline, and a fleet benchmark with your percentile.
daily · benchmarkedCost, waste, margin, drift, renewals, and trials per tenant and fleet-wide. SKU matrix, MSRP price lists, and pricing policies — with assigned-but-unused seats flagged for recovery.
waste · renewals · marginIdle seats, workload usage, cohorts, tier fit, and Copilot usage with a real ROI number — so the renewal conversation is about value, not seat counts.
copilot roi · tier fitTurn a finding into a task with an owner and a due date, track it to closure, and follow a guided runbook for the fix. Read-only by design — the change happens in your admin tools, with your audit trail.
owners · due dates · kpisFinding-threshold, change-event, metric, and AI-enhanced rules. Templates, per-user subscriptions, cooldowns that kill alert fatigue, quiet hours, and digests — to email, Teams, Slack, or a webhook.
4 rule types · 4 channelsMailboxes, permissions, inbox rules, transport rules, connectors, org config, protection policies, DKIM — correlated into the independent exfiltration vectors an attacker actually uses.
9 collectors · exfil vectorsOne ticket per finding in Jira or ServiceNow. Outbound SIEM streams in JSON or CEF with a durable cursor, replay, and a signed test event — so your SOC sees what Saxalar sees.
jira · servicenow · cefMonthly PDF reviews rendered automatically, white-labelled per customer, shared by link. Tenant export and CSV for everything else.
white-label · monthly · share linkOrg and tenant RBAC, self-service signup, guided onboarding with consent tracking, a fleet-wide Needs Attention queue, feature flags, and platform health — audited on every check.
rbac · audit-loggedNot a checklist copied from a benchmark. Each detector watches a specific change in a specific place and fires with the before/after evidence attached — tuned per tenant, with coverage you can see.
Saxalar is multi-tenant to the core — not a single-tenant tool with connectors bolted on. Your entire book of business in one command center, with the most urgent item fleet-wide floated to the top.
Every critical finding is enriched by Claude, Anthropic's frontier AI: a risk score, the business impact, the realistic attack path, and step-by-step remediation. Your analysts stop triaging and start acting.
Instead of stitching together changes, findings, and role exposure by hand, Saxalar briefs your team every morning, explains every finding in plain language, and answers questions across your whole fleet — with the receipts still attached.
Overnight: MFA was removed from CA policy 'Partner Access' at 02:14 — restore it first. The same admin elevated to a privileged role three times this week; review standing eligibility. Posture is 54, down 4 — both items above are the drivers.
"Which privileged users don't have strong MFA?" — 6 across 3 tenants. Two Global Administrators in Fabrikam registered SMS only; one in Contoso has no method at all. Evidence: auth-methods collector, 07:02 · 3 findings linked.
Three steps. No SDK install. No agents. Scoped, read-only consent — so you're returning value before your next standup.
A guided wizard discovers the tenant and hands their admin a consent link — no screen-sharing through a permissions dialog. Add more tenants anytime.
55 collectors run continuously — identities, roles, policies, sign-ins, devices, sharing, mailboxes, licenses. Delta sync lands changes in seconds.
The morning standup briefs the team, alerts reach Teams, Slack and email, findings become tasks with owners, tickets open themselves, and the monthly report writes itself.
No agents installed. No data moved. No write access to your directory. Saxalar connects through scoped, read-only Graph API consent — you see exactly what's pulled, and can revoke it in one click.
Saxalar is an observer, not an operator. It requests the minimum Graph scopes needed to read identity, role, and policy data — nothing more.
The platform under each of these already exists — the ticketing framework, the report engine, the sharing detectors, the snapshots. What's left is the last mile, and design partners set the order.
Finding → ticket in the PSA your techs already live in, with agreement sync so monitoring lands on the right invoice. Built on the same connector framework as Jira and ServiceNow.
finding → ticket · agreementsCIS Microsoft 365 Benchmark, NIST CSF, HIPAA and SOC 2 mapped to detectors and posture controls — surfaced on the posture page and inside the monthly PDF as evidence.
cis · nist · hipaa · soc 2An oversharing assessment before Copilot rollout, plus detection of unsanctioned AI apps consented into the tenant — packaged from the sharing and OAuth detectors already running.
oversharing · ai app consentsA one-off white-label report from the first collection — the document that turns a prospect's "we're probably fine" into a signed agreement.
first-scan report · white-labelSnapshots of tenant configuration already exist. Next: export the previous known-good version of a policy straight into a runbook so a drift finding comes with the fix.
snapshots today · restore nextSLA timers on remediation tasks, escalation when they slip, and PagerDuty as a first-class alert destination for the findings that can't wait for the morning standup.
sla timers · pagerdutyStacking tenants shouldn't require a call with sales. Every plan starts with a free 14-day trial — full feature access, unlimited tenants, no card required.
For a single Microsoft 365 tenant. Everything you need to see what changed and what matters.
Built for teams managing many M365 tenants at once. Per-tenant pricing, billed monthly.
For large directories, regulated environments, and custom deployment requirements.
Every MSP ships a version of the monthly M365 review. Ours is built from the same data your console shows — rendered on a schedule, already branded, already explained in plain language.
Pick a tenant, pick a window, hit export — or let the monthly job do it. The PDF arrives with a written summary, the posture trend, the findings that actually mattered, and the receipts your customer expects to see.
We built Saxalar because we were the MSP admins stitching together ten browser tabs to answer one customer question. Microsoft has the data — it just doesn't present it like a tool someone actually operates. So we made the console we wanted: read-only, tenant-aware, and focused on the two minutes before a finding becomes an incident.
Findings that matter, a posture score that proves your value, license waste turned into savings, and an AI analyst that briefs your team every morning — from a single screen.