See your identity risks. Change nothing.

Connect Microsoft 365 or Google Workspace with read-only access. Keywicket checks admin roles, MFA, dormant accounts and the apps and AI tools that can reach your data, then gives you a plain-English report with practical fixes.

Start a free scan See exactly what we read

Free during the preview. No card, no agent to install, nothing to change in your tenant.

Scan requestscontoso.onmicrosoft.com

GETgraph.microsoft.com/v1.0/roleManagement/directory/roleAssignments200
GETgraph.microsoft.com/v1.0/policies/authorizationPolicy200
GETgraph.microsoft.com/v1.0/servicePrincipals200
GETadmin.googleapis.com/admin/directory/v1/users200
POSTgraph.microsoft.com/v1.0/usersBlocked

Every request goes through one client that only allows GET to Microsoft Graph and the Google Admin SDK. Anything else is stopped before it leaves Keywicket, and the build fails if code even tries.

How it works

Sign in with your work account
Use Microsoft or Google. Keywicket inherits your MFA and never sees a password.
Connect with read-only consent
Approve a short list of read permissions, each explained. No mail, files or chat content is ever requested.
Review, comment, approve
Work through findings with your team, explain your context, and print a report with the fixes you've agreed.

What Keywicket checks

41 checks across both platforms, each with a reason it matters and the steps to fix it. The full rule library, including the exact data each check reads, is available to every registered customer.

Microsoft Entra ID 28 checks

Privileged access7
Authentication5
Account hygiene6
Applications, non-human identities and AI agents10

Google Workspace 11 checks

Privileged access4
Authentication2
Account hygiene2
Applications, non-human identities and AI agents3

Cross-platform 2 checks

Leaver and admin gaps across both2

Works alongside Microsoft and Google's own tools

Keep using Microsoft Secure Score and the Google Workspace security tools. Keywicket fills the gaps between them.

One report across both platforms: Including people disabled in one directory but still active in the other, and admins of both with weak MFA.
No premium licence needed to start: Checks that need Entra ID P1 or P2 are marked "Not assessed" with the reason, rather than quietly left out.
Read-only, so it's easy to approve: It can't lock accounts, revoke access or change policies. You stay in control of every change.
Apps, service accounts and AI tools: Which apps hold broad access to mail and files, which have no owner, whose credentials are stale, and which AI tools have been connected.
Framed for Australia and New Zealand: Indicative references to the Essential Eight, ISO/IEC 27001 and SOC 2 on every finding. Indicative only, not an audit or compliance attestation.
Your context, on the record: Comment on a finding and the adjustment is explained. The original scan score and your adjusted score are always shown side by side.