Read-only, always
No cmdlet in the module writes to a tenant. The only tenant writes in the repository are the one-time setup scripts your own admin runs: an app registration, a consent, a role grant.
Products
Three tools, one rule: read-only, nothing leaves
Available
Tenantkeep Posture
Thirteen domains, 204 checks, one interactive report. Identity, authentication, Conditional Access, devices, endpoint security, email, Purview, collaboration, Copilot readiness, governance, operations, Azure, hybrid AD. The risk register and the tenant settings live in the report itself and save back to your client folder.
Available · free to run locally
Tenantkeep CA
Conditional Access documented in plain English, with a matrix of who gets what, and a diff of every change between two dates. Free on your machine for any number of tenants. Licensed as the nightly cycle in your own Azure with change alerts to Teams or email.
In development
Tenantkeep On-Call
The on-call companion for the people who answer the phone when something breaks in Microsoft 365. Details when it ships.
How we build
Rules of the garage
Nothing leaves your environment
No telemetry, no callbacks, no licence server. The licence is a signed file verified offline against public keys built into the module. Evidence and reports stay in your folder or your storage account.
Your identities, your Azure
Local runs use the signed-in admin. The scheduled cycle runs in an Automation account in your subscription with a managed identity and read-only roles you grant and can revoke.
Read it before you trust it
The source is published. Every check is data you can read, every release is signed, and the report says which build produced it.
Pricing
Tenantkeep CA
Posture Pro
Posture Organisation
Posture MSP
Priced like the deliverable, not like an app
The Conditional Access tools are free to run locally. Everything else is a licence file per tenant, emailed to you within a minute of checkout and renewed automatically. Cancel any time; the licence runs to its expiry.
Conditional Access, nightly
$89/ year
Billed annually · applicable sales tax added at checkout
- Nightly Conditional Access snapshot in your own Azure
- Diff against the previous night, risk-relevant changes to Teams or email
- White-label change reports and history
- One tenant
One admin or consultant
$199/ year
Billed annually · applicable sales tax added at checkout
- Every domain: identity, authentication, Conditional Access, devices, endpoint, email, Purview, collaboration, Copilot readiness, governance, operations, Azure, hybrid
- Interactive report with the risk register and settings in the page
- Trend against the previous run
- One tenant at a time
An internal team
$499/ year
Billed annually · applicable sales tax added at checkout
- Everything in Pro
- White label, your logo and colours
- The scheduled cycle in your Azure: monthly report, nightly Conditional Access
- One tenant
Managed service providers
$999/ year
Billed annually · applicable sales tax added at checkout
- Everything in Organisation
- Unlimited client tenants, one licence file each
- Findings register re-import across quarters
- Priority support
Prices in US dollars. Enter your Microsoft 365 tenant ID at checkout; the licence is bound to it and nothing else. Invoice, purchase order or ACH: ask.
Contact
Talk to the person who wrote it
Kainor LLC, Spring Hill, Kansas. connor@kainor.com · github.com/Kainor-LLC