Which AI apps can reach your Microsoft 365 data?
A free, read-only scan for IT admins. One consent, a report in a few minutes.
You will be sent to Microsoft to approve read-only access, then asked to sign in so we know the report belongs to an admin of your tenant. You need a Global Administrator to grant consent.
What we read, what we keep, how to revoke
- What we read. Two read-only Microsoft Graph permissions:
Application.Read.All(the enterprise apps in your tenant, and which of them hold application permissions to Microsoft 365 data) andDelegatedPermissionGrant.Read.All(which apps your users or admins have let into Microsoft 365 data on their behalf). We cannot read mail, files, chats or sign-in logs, and we cannot change anything. - What we never see. Passwords, message or file content, PowerShell exports.
- Who this is about. The scan report is about your tenant's apps and the permissions they hold, not about a person: every user in it is a one-way code. When you sign in, we check your tenant and your admin role from Microsoft's sign-in token and store none of its claims about you: not your name, email address, user principal name or object ID. We keep a one-way hash of your tenant ID so repeat scans count once. If your IT team installs our browser extension, it sends daily counts per AI website with the employee's department, account type (work, personal or unidentified) and a content label such as "source code", worked out on the device. It never sends names, email addresses, page addresses or what anyone typed or pasted.
- What we keep. The finished report only: app names, risk ratings and counts, with every user replaced by a one-way code. Raw Microsoft responses are held in memory for the scan and then discarded. The access token is never written down.
- What we use it for. The report and the extension counts are used to produce your report and to improve our catalog of AI sites. They are not shared with anyone else and not combined with other customers' data today. If that changes, this page changes first, and you are told before your data is included.
- Where it is kept, and for how long. In a file store on our server, readable only by the account that runs the scan service. A report opens only in the browser session that ran the scan: we keep a one-way hash of that session's token and check it before showing the report. We keep a report for 90 days from when it is saved, then delete it. Extension counts have no fixed window yet: we delete them when you ask, and when a deployment's key is revoked and deleted.
- Delete. The report page has a delete button. It removes the report from our storage immediately. What remains is a one-line record that a scan was deleted, holding a short hash of the scan ID and no tenant data, and our metrics line for the scan: the tenant hash and three counts (apps, AI apps, high-risk AI apps). Reports past 90 days are deleted without a request. For the extension, ask us and we delete every count for your deployment and revoke its key.
- Revoke. In the Entra admin center, open Enterprise applications, find ChainSpark AI App Scan, and delete it. That removes our access completely. To withdraw the browser extension, remove its force-install policy in Intune or Group Policy and ask us to revoke your deployment key; from then on our server refuses anything sent with it.
- What this scan cannot see. AI tools used in a browser without connecting to Microsoft 365, desktop AI apps, and personal phones. This report is not a full inventory of AI use, and it does not claim to be.