What this is
Can you change anything in our Microsoft 365?
No. The app only reads. When your admin approves it, Microsoft adds a record of the app to your account. That record is the one thing the app can change, so it can delete itself when you're done.
For your IT person: It uses Microsoft's "Manage apps that this app creates or owns" permission. After approval it makes itself the owner of its own service principal, and on revoke it deletes it. Microsoft's permission would also let an app create new apps. This one never does, and it can't change any app it doesn't own.
What does it actually do?
It checks your Microsoft 365 for the things cyber insurers ask about, like whether signing in takes more than a password. Then you get a written report: where you stand, what to fix first, and how you'd answer the questions on Travelers' and At-Bay's applications.
Do we need our IT person?
Someone with admin rights to your Microsoft 365 has to approve the connection. That's how Microsoft protects your account. If your IT is a contractor, a short call with them usually does it.
Your data
Is our data used to train AI?
No. I use Azure OpenAI, which runs inside Microsoft's cloud. Microsoft's terms say what's sent to it isn't shared with other customers or used to train any models. It's a different setup from the public ChatGPT.
Azure OpenAI data privacy ↗
What don't you read?
Your email, Teams messages, calendars and the files in your Microsoft 365. Nothing in the assessment reads them, and the app doesn't ask for permission to. The only files read are ones uploaded to your workspace. It doesn't read passwords either. One check sees when the passwords on apps set up in your account expire, and keeps only which apps are affected.
For your IT person: None of the permissions listed below can read mail, calendars, Teams messages or files.
What do you read about our computers and phones?
Which devices are enrolled in Microsoft Intune, whether each one is encrypted, protected by Microsoft Defender and up to date, and which update and compliance rules apply. Not what's on them.
For your IT person: The Intune device list, each Windows device's Defender state, the compliance policies, the Windows Update rings and the app protection policies, read-only. Device names stay in your report's appendix. An account without Intune gets "not licensed" on those checks, not a gap.
Do you read our Azure?
Only if you connect it. Your Azure admin gives our app Azure's Reader role on the subscriptions you choose. I then read how backups, network rules and Microsoft Defender are set up there. Reader can't change anything, and can't read your data, keys or passwords.
For your IT person: The role is assigned per subscription in Access control (IAM), to the same app your Microsoft 365 admin approved. To disconnect, remove that Reader role; Settings checks again and shows what's still connected. Resource names, like your machines and vaults, stay in your report's appendix.
What do you send to the AI?
Counts and settings. For example, how many admins don't have a second sign-in step, or how many sign-in rules apply to everyone. Plus what you tell me about your business. The AI never sees the people behind a count. Their names are only in your report's appendix. It never sees your email or the files in your Microsoft 365. If you upload a document, like your incident response plan, the AI reads it and suggests answers to the insurer's questions it covers. No answer is recorded until you accept it.
For your IT person: Settings go by the names your admins gave them, so a policy named after a person keeps that name. Any email address in a name is removed first. Some steps let the AI search the public web through Microsoft's Bing, to research your industry and check its sources. It writes those searches from what it has read, like your company's name, your industry and the gaps it found. Those searches leave Microsoft's cloud and follow Bing's terms.
How the web search works ↗
Where is our data kept, and who owns the report?
In Microsoft's cloud in the eastern United States, encrypted. The report is yours, and I don't share it with anyone.
For your IT person: Storage and the database are in Azure East US, encrypted at rest and in transit, with credentials in Azure Key Vault. The AI runs on Azure OpenAI deployments that may handle a request in any Azure region. Anything it stores stays in the United States. Who can open your workspace is answered below.
Azure storage encryption ↗Where Azure OpenAI processes data ↗
Can we delete everything?
Yes. A workspace admin can delete an assessment in the portal. Its report, its working files and its records go right away, and it can't be undone. To delete your whole workspace, with your answers, the documents you uploaded, your contacts and history, email me at support@insurancepreflight.com.
For your IT person: Two copies last a little longer. Database backups roll over within 7 days, and Microsoft keeps each AI response for 30 days. I also keep a record of what the AI work cost, without what it said. There's no minimum time I keep anything.
Access, and taking it back
What permissions does the app ask for?
They're all listed below, with what each one is for. The assessment uses every one, so all of them are required. One lets the app remove itself when you ask. The rest only read.
For your IT person: The list is read live from the file the app's Microsoft registration is built from.
Can we leave one out?
No. Each one answers part of the report, and a report with parts missing would look finished when it isn't. If one worries you or your IT person, email me and I'll show you exactly what it answers.
For your IT person: If your account stops granting one, the assessment won't start, and Settings shows which one and how to grant it again.
How do we take it all back?
Press Revoke in Settings. The app deletes itself from your Microsoft account, which also ends any Azure access you gave it. If it can't, Settings tells you the one step left for your admin.
For your IT person: You can also do it from your side. In the Microsoft Entra admin center, under Enterprise applications, find "Insurance Preflight" and delete it. Once it's gone it can't get new access, and any access it already has runs out within 90 minutes. The portal clears its record once Microsoft confirms the app is removed or disabled. If you gave it Azure's Reader role, the role then shows in Azure's Access control as an unknown identity until you remove it there.
Who you're dealing with
What certifications do you have?
Not yet. Microsoft holds certifications for its cloud, but I don't have any of my own. What you can check is on this page: what the app can read, the one thing it can change, and how to remove it. If I get one, it'll be listed here.
Who can see our data?
The people in your workspace, and me or anyone who helps me run it. Everyone has to sign in.
For your IT person: One exception: someone in your workspace can create a key so their own AI tools can read one finished assessment, including its report and the evidence behind it. Anyone holding that key can read it for 90 days, and the key can't be cancelled early, so keep it like a password.
What if this page doesn't answer my question?
Email me at support@insurancepreflight.com. I read it myself, and I'd rather answer a hard question before you connect anything.