Open-source tool · TenantWarden

TenantWarden

Self-hosted security monitoring for Microsoft 365 tenants.

TenantWarden brings signals from several Microsoft 365 tenants into one dashboard. Its collector reads Microsoft Graph data on a schedule or on demand, while alert and analytics services organise findings, compliance trends and notifications. An optional cross-platform agent streams endpoint metrics. The project is under active development, so the README recommends a private network or VPN for now.

View on GitHub ↗Quick start

Deployment: Self-hosted with Docker Compose
Tenants: Multiple from one install
Agent: Windows, Linux and macOS
License: MIT

Why it exists

Questions it answers

What changed across my tenants?

Scheduled Microsoft Graph collection brings risky users and sign-ins, Intune devices, Conditional Access, Secure Score and service health into one place.

Which findings need action?

Alerts have severity and status, with acknowledge, assign and resolve workflows and tenant-scoped access.

How is compliance moving?

Framework controls are scored from collected signals, with history and trends.

Can I see endpoint signals too?

A Go agent for Windows, Linux and macOS streams host metrics through a token-authenticated gateway.

Features

What it does

Microsoft 365 collection

Identity risk and risky sign-ins
Intune device compliance and authentication method registrations
Conditional Access policies, Secure Score and service health
Scheduled and on-demand collection

Alerts and compliance

Severity and status workflow
Tenant-scoped access control
Compliance scores, history and trends
Email, Teams, Slack, webhook, PagerDuty, ServiceNow and Jira channels

Endpoint agent

Go binaries for Windows, Linux and macOS
Per-tenant enrollment tokens
Token-authenticated WebSocket gateway
Host metrics streamed to the platform

Self-hosted stack

React and TypeScript dashboard
ASP.NET Core API and authentication services
Collector, alert, analytics and scheduler services
PostgreSQL, Redis and ClickHouse

How it fits together

Architecture

01Microsoft Graph and endpoint agents
02Collector and agent gateway
03PostgreSQL and ClickHouse
04Alert and analytics engines
05Dashboard and notifications

Quick start

Try it

Run the development stack

git clone https://github.com/jahmed-cloud/TenantWarden.git
cd TenantWarden
make setup-env
make certs
make build
make up
# Open http://localhost:8090 and change the default admin password

The full setup guide is in the README on GitHub.

Before you start

Requirements and permissions

Host	Docker Engine 24+, Compose v2, Python 3 and OpenSSL for setup
Identity and policy	IdentityRiskyUser.Read.All, AuditLog.Read.All, Policy.Read.All
Devices and security	DeviceManagementManagedDevices.Read.All, SecurityIncident.Read.All, SecurityAlert.Read.All, SecurityEvents.Read.All
Service and compliance	ServiceHealth.Read.All, Reports.Read.All, InformationProtectionPolicy.Read.All

Good to know

The README says the collection, alerting, compliance and access-control paths work end to end, but other parts are still being finished. Run it on a private network or VPN while development continues. Replace the default admin password at first sign-in, and review the repository security audit before production use.