Your Microsoft 365 tenant under control, even with a small IT team.
An AI agent handles routine tasks and reporting across Entra ID, Exchange, Intune, Teams, SharePoint, Defender and Sentinel. It only changes what you have approved.
Common questions in day-to-day admin work
Which accounts and groups is nobody using any more? Which app registrations have which permissions, and does anyone still need them? Who has admin rights but hasn't signed in for months?
In many tenants, each of these takes time: several admin centers, a PowerShell script, a spreadsheet. A small IT team rarely gets to them, until an audit or an incident makes them urgent.
What tenant/ops_ does for you
Reports across all admin centers
"Which inactive accounts still have licenses or admin rights?" The agent checks sign-ins, licenses and roles and gives you a list.
Offboarding on the leaving date
Block the account, end sessions, remove groups and licenses: as a workflow that runs on the leaving date and waits for your approval first. You can cancel it any time before then.
Security incidents from Defender and Sentinel
The agent puts together a timeline and the affected objects and suggests a severity, with its reasons. It can also isolate a device once you approve.
No change without your approval
- Preview before every change. You see what would change. Nothing runs until you agree. Each approval covers only that one change and expires after a few minutes.
- Separate approval for permanent changes. Anything that can't be undone, such as deleting a user for good, isn't approved in the chat but in a separate browser window. You sign in again there, and only the person who started the change can approve it.
- The signed-in admin's permissions. In the chat, the agent works with the permissions of the admin who is signed in. If you can't do something in Microsoft 365, neither can the agent. MFA and Conditional Access still apply.
- Audit log. Every change made from the chat is logged in Azure Log Analytics: who, what, which object, which approval. Query it with KQL or forward it to your SIEM.
- Your own instance in West Europe. Each customer gets a separate instance with its own data storage in the Azure West Europe region. No copy of your tenant: data is fetched live when needed.
- Permissions through admin consent. You grant them through admin consent, can see them in Entra ID and can revoke them at any time. You get the full list in advance.
Simon Lenz
IT Security Consultant, IT Security Engineer & AI Engineer
I have worked in IT security for more than ten years.
In many Microsoft 365 environments I see the same pattern: the tenant grows faster than the rules and documentation around it. A project here, a quick fix there, an admin who leaves and takes what they knew with them. Often nobody has agreed who creates what, how things are named or who owns them. And day-to-day work leaves little time to tidy up. The result: accounts and groups nobody uses, app registrations whose permissions nobody can explain any more, and recurring tasks still done by hand. The admin centers don't help much, because they spread the important details across many pages or don't show them at all.
I developed tenant/ops_ so that admins can get that overview quickly and clean up step by step, without giving up control. If you request a live demo, you'll be talking to me.
LinkedInRequest a live demo
In the live demo I show you tenant/ops_ with a question from your own work, in a demo tenant with sample data. Your tenant isn't touched. Send me a short note about what you'd like to see and I'll get back to you with some times. I can also send you the four-page product overview beforehand.
Frequently asked questions
What permissions does tenant/ops_ need in our tenant?
An admin at your company grants them through admin consent. Before that, you get the full list, split into delegated and application permissions. In the chat, the signed-in admin's own permissions always apply on top.
Where is our data stored?
In your own instance in the Azure West Europe region. tenant/ops_ doesn't copy your tenant; it only stores what it needs to run, such as chat history (90 days by default). The language models are Anthropic's (Claude).
Does it work without the portal?
Yes. The same functions are available directly in Claude Code. Changes there are only possible in clients that can show a confirmation prompt.