How we access and handle your device inventory
The service reads inventory and analytics your management platform already holds. It writes nothing back, and it never sees a file, a mailbox or a keystroke.
What we read
- Read-only Microsoft Graph permissions: DeviceManagementManagedDevices.Read.All, DeviceManagementApps.Read.All, DeviceManagementConfiguration.Read.All, Organization.Read.All and User.Read.All for the device-to-user link.
- For Configuration Manager, a read-only export from Resource Explorer or your reporting point, or a read-only SQL login on the v_R_System, v_GS_COMPUTER_SYSTEM, v_GS_OPERATING_SYSTEM and v_GS_VIDEO_CONTROLLER views.
- No device agent, no write scope, no mailbox or file access.
What is never collected
- File contents, documents or mail.
- Browsing history or keystrokes.
- Anything a device agent would see. There is no agent.
- User names and email addresses, if you strip them from the export first. The report works on device identifiers alone.
Where it runs
- In a US or EU region we operate, as you choose, with the data region confirmed in writing before any export is sent.
- Or in your own Azure tenant behind your own identity provider, with your keys and your logs, for the Scale band and above.
Export mode never connects to the tenant at all: a file goes through the secure link and the verdicts come back. Connected mode uses one application registration you create, with read scopes only, which your administrator can revoke from Entra at any time.
Before any real data
In this order, before any export is sent or any scope is consented.
Request your initial report- A data processing agreement, yours or ours.
- For connected mode, a dedicated application registration in your tenant with admin consent to read scopes only, which you can revoke at any time from Entra. Export mode requires no application registration.
- Confirmation of the data region and of who on our side can open the data.
Who builds and runs it
QueryNow has run Microsoft 365, Intune and digital workplace programs for enterprises since 2014, with more than 200 production deployments on AI and the Microsoft platform, teams in Texas and Munich, and Microsoft Solutions Partner status. The endpoint scoring model was built for a customer pilot on a fleet of tens of thousands of devices, documented in an anonymized case study. The customer chooses the data region and keeps the keys when it runs in their tenant.
Get the refresh findings for your fleet
Send us the form and we will reply within one business day with a secure upload link and the export steps for your platform. The PDF follows within five business days of the export.