Access Optional
Who holds the keys to Defender?
Gapsio reads Defender XDR unified RBAC: who holds which Defender role, which data sources it covers and whether it was ever used – no matter if it was assigned directly, through a group, eligible in PIM for groups or through an access package in entitlement management.
Who can do what?
Search by role or a single permission – live response, for example – and see everyone who has it, or could get it.
My access, for everyone.
Every employee can see their own Defender roles, with links to PIM and My Access. No ticket needed.
Apps with Defender rights.
Service principals that can offboard, isolate or run live response through the Defender APIs – with client secrets, credential lifetime and owners. Plus role groups without access review and PIM activation without MFA.
What happened in the portal.
From the Purview audit log: who downloaded an offboarding package, who ran live response, which settings were changed. None of it shows up in a device timeline.
Held, but not used.
For every permission a person holds, Gapsio checks whether it was used in the last 30 days – response actions, live response, alert triage, settings changes. “Not used” only appears when every source that could show the use was read; otherwise the permission is “not measurable”, with the reason.
See it in your own tenant.
Read-only, self-hosted in your Azure subscription, running in minutes. Every check is free.