STAR Assessment

Lite · runs in your browser

  1. Sign in
  2. Check access
  3. Assess
  4. Results

Your data stays in this browser

You sign in with your own Microsoft account. Microsoft sends your tenant's configuration straight to this tab, and the assessment and its reports are built here.

Nothing is sent to Refoundry. Close the tab to clear everything, or download the reports to keep them.

What Lite assesses

Microsoft Entra and ID Governance, Global Secure Access, Defender (Secure Score, vulnerabilities and advanced hunting), Intune, SharePoint, Microsoft Sentinel and Azure, Power Platform, and public email DNS.

Exchange Online, Defender for Office 365, Purview and Teams settings need PowerShell, so Lite shows their checks as not evaluable. The full assessment covers them.

Access, permissions and data handling

Every call reads. Nothing in your tenant is created or changed. Results depend on your own roles: Global Reader, Security Reader and Reader on your Azure subscriptions cover the assessment.

Sign-in tokens stay in this tab's session storage and are cleared when it closes. Public email DNS records are looked up through Cloudflare by domain name only, never with a Microsoft token.

The assessment engine is loaded into this page and runs here. A typical run makes 100 to 200 read calls and takes a few minutes.

Preparing the assessment engine...
Technical log