Stepix Core
read-onlyRead the directory: accounts, licences and sign-in activity.
- User.Read.All
- Organization.Read.All
- AuditLog.Read.All
- Directory.Read.All
Security
Exactly what Stepix can do in a tenant.
Each module is its own Microsoft application with its own admin consent, so a tenant grants only what it uses — and can see, on Microsoft’s consent screen, the same permissions listed here.
Stepix Offboarding
can change thingsRun the seven offboarding actions against a leaver's account.
- User.ReadWrite.All
- User.RevokeSessions.All
- Mail.ReadWrite
- MailboxSettings.ReadWrite
- Files.ReadWrite.All
- AppRoleAssignment.ReadWrite.All
Stepix App Hygiene
can change thingsRead every app registration and its credentials, and revoke an OAuth consent a user granted.
- Application.Read.All
- DelegatedPermissionGrant.ReadWrite.All
Stepix Guest Lifecycle
can change thingsRemove a guest account from the tenant. The guest report itself needs no new access.
- User.ReadWrite.All
Stepix CA Analyzer
read-onlyRead every policy in the tenant, Conditional Access and otherwise, and simulate a sign-in against them. Read-only — it changes nothing.
- Policy.Read.All
Stepix Joiner and Mover
can change thingsCreate staff accounts, set their manager and job details, assign licences, and add or remove group membership. It cannot create or delete groups, and it cannot touch groups that Entra roles can be assigned to.
- User.ReadWrite.All
- GroupMember.ReadWrite.All
- LicenseAssignment.ReadWrite.All
Stepix Devices
read-onlyRead the devices Intune manages — compliance, encryption, when each last checked in — and the device policies. Read-only: it cannot wipe, lock or change a device.
- DeviceManagementManagedDevices.Read.All
- DeviceManagementConfiguration.Read.All
Stepix Defender
read-onlyRead Microsoft Defender's incidents and alerts, and Secure Score. Read-only: it cannot close, assign or change an incident.
- SecurityIncident.Read.All
- SecurityAlert.Read.All
- SecurityEvents.Read.All
Stepix Advanced security
read-onlyRead which accounts Microsoft considers at risk, who can activate an admin role through Privileged Identity Management, and run Stepix's read-only hunting queries over Defender's advanced hunting data. Read-only, and the consent behind the Advanced security add-on.
- IdentityRiskyUser.Read.All
- RoleEligibilitySchedule.Read.Directory
- ThreatHunting.Read.All
What Stepix keeps
As little as answers the question.
No tokens in the database
Stepix signs in to each tenant as its own registered application. The secrets live in Azure Key Vault and are read by a managed identity; the database holds only their names.
Not a copy of your tenant
Conditional Access policies are kept as fingerprints, so a change can be noticed without storing how you configured your access controls. Defender incidents are kept without the users, devices or addresses behind them.
Changes without people
The audit-log changes Stepix keeps name the app, policy or domain that changed — never who made the change, and never a person's account.
E-mail carries counts
The Monday e-mail says how many things need doing per client. Names stay inside Stepix, behind sign-in.
How it is run
Accountable by design.
Every action on record
Every change made through Stepix is logged with who asked for it, in which tenant and when, and every member of the workspace can read the log.
Dry run by default
Offboarding, onboarding and guest removal show their full effect first. Nothing changes until someone presses the button that names the person.
Sign-in through Microsoft
Operators sign in with their Microsoft work account. Stepix keeps no passwords.
Where it runs
Microsoft Azure, in Sweden Central and West Europe. E-mail is sent through Azure Communication Services with an EU data location.