CtrlConnect FAQs

CtrlConnect is a read-only governance console for Microsoft 365 that brings identity, security, compliance, and workspace activity into one place — so IT teams can prove what's happening, fix what's not, and move faster without breaking tenant guardrails.

Most tenants are live in under 15 minutes. You sign in with a Global Reader (or equivalent read-only) account, grant the four least-privilege Graph scopes, and the first sync completes within seconds. Full historical backfill of 12 months of audit logs runs in the background and typically finishes within an hour.

No. We use a dedicated least-privilege application registration with four read-only Graph scopes. A Privileged Role Administrator needs to approve the consent once, then any user with the CtrlConnect license can sign in. We never ask for write permissions unless you explicitly enable a remediation workflow.

Yes. There is no per-tenant fee — connect every tenant in your portfolio (production, dev, M&A holding companies) and switch between them from a single pane. Cross-tenant search and reporting are included on Business and Enterprise plans.

We pull every Conditional Access policy from Entra ID, render it as a visual decision tree, and surface what each policy actually allows across users, apps, and locations. Drift detection runs hourly and alerts you when a policy change weakens your posture — before users notice.

Yes. The identity module ships with 40+ out-of-the-box signals — stale sign-ins, dormant mailboxes, unlicensed admins, MFA gaps, passwordless coverage, guest sprawl, and more. Build your own queries with a no-code filter or ask CtrlConnect AI in plain English.

No — it sits alongside them. CtrlConnect is read-only by default, so it never competes with tools that provision or rotate credentials. Instead, it gives you an audit-grade view of what those tools are actually doing, plus the evidence you need for ISO, SOC 2, and GDPR.

The lifecycle module reads HRIS webhooks (Workday, BambooHR, HiBob, Personio) and reconciles them against Entra ID. Every joiner, mover, and leaver generates an auditable workflow with assigned owners, SLAs, and Slack/Teams notifications — no spreadsheets required.

CtrlConnect is SOC 2 Type II audited, ISO 27001 certified, and operates under a GDPR-compliant DPA. HIPAA-aligned controls and EU-only data residency are available on Enterprise plans. Reports and attestations are available under NDA via your account manager or the trust portal.

You choose during signup — currently EU (Frankfurt) or US (Virginia). We never replicate across regions without an explicit migration request. Audit logs and metadata are encrypted at rest with per-tenant keys you can rotate from the dashboard.

Self-hosted deployment is available on Enterprise plans for organizations with strict data-residency requirements. We support Azure and AWS as target environments, with a dedicated solutions engineer to help with the rollout and a private Helm chart you control end-to-end.

We stream Entra ID sign-in and audit logs into a detection engine tuned for Microsoft 365 — covering impossible travel, token replay, OAuth consent abuse, mailbox rule tampering, and 60+ other behaviors. High-fidelity alerts route to ServiceNow, Jira, PagerDuty, or Slack via your existing runbooks.

Out of the box: ISO 27001, SOC 2 (Common Criteria + Trust Services Criteria), GDPR, NIS2, CIS Microsoft 365 Benchmark, and Microsoft's own Entra ID baseline. Each framework has a pre-built control library that maps to live queries against your tenant — evidence refreshes automatically as your environment changes.

Yes. Every control has an exportable evidence package: PDF for auditors, CSV for analysts, JSON for GRC tools. Time-stamped snapshots are signed and stored for 7 years. Common integrations include Vanta, Drata, Secureframe, OneTrust, and Tugboat Logic.

Controls run continuously. As soon as a configuration changes — a Conditional Access policy weakened, a new admin added, a guest granted a SharePoint role — the control flips state and the change is logged with a diff. Auditors see one source of truth, not a quarterly screenshot.

Yes — all three are first-class. Alerts open as tickets with full tenant context attached, bi-directional sync keeps status in lock-step, and Slash commands let you query posture from inside Slack. A webhook and a structured JSON API cover anything custom.

Yes. We ship native integrations with Microsoft Sentinel, Splunk, Datadog, and Elastic, plus a Syslog forwarder and an Event Hubs streaming endpoint for everything else. Events are normalized to OCSF so they slot into your existing detections.

Yes. The public REST API mirrors everything in the UI — inventory, alerts, controls, evidence, and lifecycle workflows — with predictable pagination, idempotent writes, and OpenAPI 3.1 specs. A Python SDK and Terraform provider are bundled with every plan.