Security License Lens

The security you already own (and ignore).

CLI: licenselens · Requires Python 3.12+

Security License Lens finds Microsoft security configuration debt: high-value capabilities in E5, Entra ID P2, Defender, and related SKUs that stay at default or unused. It starts from owned entitlements, maps them to expected controls, and reports gaps as you pay for X → expected Y → observed Z.

Sample report (dry-run): examples/sample-report/

Quick start

# One-command offline demo → HTML report
pipx install licenselens   # or: pip install -e ".[dev]"
licenselens demo

# Interactive scan: prompts for anything missing (TTY)
licenselens scan

# Or jump straight to a live tenant walkthrough
licenselens quickstart

In a terminal, licenselens scan asks demo vs live tenant, sign-in method, and other missing options. Flags and AZURE_* env vars always win when set. Non-interactive environments default to dry-run (or exit with a clear error on --live without credentials).

Default priority packs are identity + endpoint. They shape the headline rollup and top actions; enabled checks still evaluate unless --workload filters them. Email policy config is not readable via Graph (PowerShell-only); use --allow-email-proxy only if you explicitly want a labeled Secure Score degraded path.

Live / MSP

licenselens doctor --live --auth client_secret
licenselens scan --live --auth client_secret -o reports
licenselens batch tenants.yaml -o reports

Why Security License Lens?

Diff, discovery, and batch

# Compare two scan JSON artifacts by check_id
licenselens diff reports/before.json reports/after.json -o reports/diff.md

# Discover Sentinel-capable workspaces (prints ARM resource IDs)
licenselens discover-workspace --auth client_secret

# Multi-tenant scans from tenants.yaml (per-tenant reports + index.md)
licenselens batch tenants.yaml -o reports

Full check pack (v0.3.0)

Unlicensed capabilities report not_licensed instead of false gaps.

Known limitations

See docs/limitations.md for the full list. Short version:

• Email pack off by default — no Graph API for MDO policy config (PowerShell-only); --allow-email-proxy is opt-in and labeled
• MDI / Purview may still use Secure Score proxies (starter packs)
• Sentinel needs a workspace ARM ID + Azure RBAC
• Sign-in / MDE inventories may truncate on huge tenants
• Findings are advisory, not a compliance certification
• No product telemetry by default

Architecture

SKUs / service plans → capability catalog → eligible checks
        → collectors (Graph / MDE / ARM) → findings → HTML / JSON / Markdown

Permissions

See docs/permissions.md and docs/app-registration.md.

Exit codes

Contributing

See CONTRIBUTING.md and docs/adding-a-check.md.

Security

SECURITY.md — read-only, no telemetry by default.

License

MIT

Disclaimer

Security License Lens is an independent open-source project and is not affiliated with, endorsed by, or sponsored by Microsoft Corporation. Findings are advisory. “Microsoft”, “Entra”, “Defender”, “Sentinel”, and “Purview” are trademarks of their respective owners.