CNNECT Lens · Setup

Set up Lens in two minutes.

Approve the app once for your organisation, then anyone with read access can sign in and run the assessment. Want to look first? Explore the demo.

Approve Lens for your organisation

An admin approves Lens's read-only Microsoft Graph permissions once, for everyone in the organisation. Nothing is written to your tenant and no secrets are created.

Global AdministratorCloud Application AdministratorPrivileged Role Administrator

Organisation (optional) Leave blank to approve for whichever organisation the admin signs in to. That's usually what you want.

I'm an admin: approve now

Your admin will see the app name, its publisher and the permissions below, then return to a confirmation page. You can remove Lens at any time under Entra admin centre › Enterprise applications.

What Lens can read, and why

Permission (delegated, read-only)	Used for
User.Read	Signing you in.
User.Read.All	Users, account status and license assignments.
LicenseAssignment.Read.All	Subscribed licenses, quantities and service plans.
Organization.Read.All	Organisation name and settings.
AuditLog.Read.All	Last sign-in per user, and sign-in logs for Power BI, Visio, Project and workload usage.
Reports.Read.All	Microsoft 365 usage reports: mail, Teams, OneDrive, SharePoint, apps and Copilot.
ReportSettings.Read.All	Checking whether report names are concealed.
DeviceManagementManagedDevices.Read.All	Intune devices, to show who uses managed devices.
ThreatHunting.Read.All	Defender advanced hunting: sign-in usage and shadow AI.
CloudApp-Discovery.Read.All	Cloud Discovery, for shadow AI when hunting isn't available.
AuditLogsQuery.Read.All	Purview audit search, for free Copilot Chat usage.
Place.Read.All	Room mailboxes, so licensed rooms are spotted.

Sign in and run the assessment

Sign in with your work account. Lens detects your organisation from your account, collects the data and builds the report in your browser. Most runs take 5–15 minutes.

Global ReaderReports Reader+ Security Reader for Defender data+ Purview Audit Reader for Copilot Chat

Assessing another organisation (CNNECT consultants)

Signing in normally opens your own tenant. To assess a customer through GDAP or a guest account, enter their tenant. The sign-in link then opens that tenant.

Customer tenant

Using your own app registration instead of Lens's? Open the assessment page and choose Advanced connection settings.

Common questions

Where does our data go?

Lens runs in your browser and calls Microsoft Graph directly, with your sign-in. The first time you run it, you register your name, job title and company. When the assessment finishes, the full report (licenses, usage, costs, and the names and activity of people in your organisation) is saved securely to CNNECT in the UK, so a consultant can review it with you. It's kept for 180 days, never shared or sold, and you can ask us to delete it sooner. Nothing is ever written to your tenant. See the privacy policy.

Can Lens change anything in our tenant?

No. Every permission is read-only and delegated, so Lens can never see more than the signed-in person can, and it writes nothing.

Our usage reports hide user names. Does it still work?

Yes. Lens maps Exchange, Teams, OneDrive, SharePoint, Office and Power BI usage from sign-in events instead, so you don't have to turn the privacy setting off. A few report-only details, such as mailbox sizes and Copilot usage, need names to be visible. The report shows which.

How do we remove it?

Entra admin centre › Enterprise applications › find the app › Properties › Delete. This removes the approval for everyone.

Our admin can't approve the app

Some organisations send new apps through an approval request first. Your admin can approve Lens from the Entra admin centre once the request reaches them. If you're stuck, contact CNNECT and we'll help.