How it works
A scan takes a few minutes. Keywicket reads directory settings and metadata through read-only APIs, runs its checks, and shows you what it found. You decide what's right for your organisation.
The steps
Sign in
Sign in with your Microsoft work account or your Google Workspace account. Keywicket uses your existing sign-in and MFA, so it never holds a password for you.
Read how Keywicket handles your data
Before you can connect a tenant you're asked to confirm you've read the security and data handling page. It lists every permission, what it's used for, and how long anything is kept.
Connect your tenant
Microsoft: a Global Administrator approves Keywicket's read-only application permissions on Microsoft's own consent screen. Keywicket stores only your tenant ID; it gets short-lived tokens with its own certificate.
Google: a super admin authorises read-only Admin SDK scopes. One scope, used to list third-party app access, is optional. If you leave it out, the two checks that need it show "Not assessed". If your Workspace blocks unconfigured third-party apps, you may first need to mark Keywicket as trusted in Security → API controls; the connect screen walks you through it.
The scan runs
Keywicket reads in small batches to stay within Microsoft and Google rate limits. If a check needs a licence or permission you don't have, it says "Not assessed" with the reason. It never treats missing data as a pass.
Review findings
Each finding names the affected users, apps or policies (with their IDs and last activity), explains why it matters, gives practical fix steps, and shows indicative Essential Eight, ISO/IEC 27001 and SOC 2 references.
Add your context
Comment on any finding. Keywicket sorts each comment into one of a fixed set of categories, and a fixed table decides what changes. The original finding and score are always kept.
Approve and print the report
Approve findings as found or after adjustment. The report includes approved findings only, with both scores, the feedback trail and the fixes. Anything not yet approved is listed in a "Pending review" appendix. Print it or save it as PDF from your browser.
How the Identity Risk Score works
The score starts at 100. Each triggered check subtracts points by severity: Critical 10, High 6, Medium 3, Low 1. A check counts once, plus 50% if it affects more than 10 objects. The score can't go below 0.
| Score | Band |
|---|---|
| 85 to 100 | Good |
| 65 to 84 | Fair |
| 40 to 64 | Poor |
| Below 40 | Critical |
Only checks that have been validated against a live test tenant count towards the score. Newer checks appear as "Beta, not scored". Checks marked "Not assessed" are left out, and every report says how many checks were assessed, so a high score from limited data isn't mistaken for a clean bill of health.
What your comments can change
A language model reads your comment, but it can only choose one category from this list. Anything else is treated as "Unclear". The model never edits findings, scores or text.
| Category | Effect on the finding | Effect on the score |
|---|---|---|
| False positive (with your reason) | Marked “Disputed by customer” and left out of the adjusted score | Points removed from the adjusted score |
| Compensating control in place | Severity lowered one level; the fix is reworded to verify your control | Points recalculated |
| Risk accepted | Severity unchanged; marked “Risk accepted by customer” | Unchanged |
| Remediation planned (with a date) | Severity unchanged; your target date is shown | Unchanged |
| Already fixed | Flagged for re-check on the next scan; nothing changes until the scan confirms it | Unchanged until re-scan |
| Context or question only | Your comment is attached; nothing else changes | Unchanged |
| Unclear | Nothing changes; you're asked to rephrase | Unchanged |
A Critical finding can be lowered by at most one level and is never removed by a comment alone. A disputed Critical stays in the report as "Disputed — Critical".
Monitoring and alerts
Connected tenants are re-scanned nightly. When a new finding appears, workspace members get an email with the finding's title and severity. Names of affected users and apps stay in the workspace, not in email.
Disconnecting
Disconnect stops scanning straight away and deletes the raw directory data and any stored Google token. Your findings, comments and reports stay for 30 days so you can still print the report, then they're deleted. Delete all data now removes everything for that tenant immediately.
If you revoke Keywicket's consent in Microsoft or Google instead, Keywicket notices on its next attempt and disconnects the tenant the same way.