The facts behind AppAlert's read-only access
Review the Microsoft permissions AppAlert requests, the data it stores, where providers process it, and the controls in place today.
Review topics
- Permissions
Every Microsoft Graph application permission is read-only. AppAlert uses it for credential inventory, ownership context, and App Proxy coverage.
- Data handling
AppAlert stores directory metadata needed to find expiring credentials and route warnings. It never receives secret material used to authenticate apps.
- Service providers
AppAlert uses four core providers to authenticate users, read Microsoft Entra metadata, run the application, store product data, and deliver email.
- Data location
AppAlert keeps application compute and its primary database together in Frankfurt. Global delivery and email providers have separate processing footprints.
- Retention and revocation
Revoking Microsoft consent stops future inventory reads. Deleting AppAlert data is separate, so admins can keep the queue and notification record.
- Assurance
AppAlert is an early-stage product. It does not claim certifications it has not earned. This page separates AppAlert controls from provider attestations.