Discover
Inventory accessible SharePoint sites, Teams-connected content and OneDrive accounts, while distinguishing accessible, denied and unverified locations.
Microsoft 365 visibility and governance
Know what matters. Protect it with confidence.
Discover, understand and protect Microsoft 365 content across SharePoint Online, Microsoft Teams and OneDrive—from a local Windows workspace built for administrators and governance teams.
DDC Guardian 365 is in active development. Public capabilities on this site reflect the current verified product implementation.
Microsoft 365 overview
Visibility, risk and recommended next steps.
Documents analyzed1,240
Need attention86
Coverage68%
Recommendations43
Coverage
AccessibleAttention
Risk
Classification
A clear path from estate to action
Visibility before change
DDC Guardian helps administrators build evidence, focus review and apply governance only when the necessary permissions, edition and safeguards are present.
Understand
Analyze selected content, review coverage and risk, and generate classification and metadata recommendations without changing Microsoft 365 in dry-run.
Review
Explore results, exact remediation locations, site and label reports, audit evidence and read-only permission findings.
Protect
Use Professional safeguards, explicit approval and delegated runtime checks for supported metadata and sensitivity-label operations.
Product experience
Understand your Microsoft 365 estate at a glance
The current premium dashboard focuses on four operational signals and three deliberately simple visual views: Coverage, Risk and Classification. Selections lead into Discovery or Review so evidence remains actionable.
Coverage
Know what is reachable
Separate accessible, denied and unverified locations. Coverage is evidence-based and does not assume tenant-wide visibility from a partial Microsoft Graph result.
Risk
Direct attention
Review high, medium and low risk distributions and move from a summary view to matching results and their exact Microsoft 365 locations.
Classification
See recommendations
Understand recommended classification distribution while preserving the boundary between analysis, preview, approval and write operations.
Illustrations use generic demo data.
No development tenant identifiers, user accounts, client IDs, site URLs, tokens or internal customer information are used on this website.
Discovery
Build a trusted Microsoft 365 inventory
Start with the locations the delegated technical account can actually validate, then select the exact targets to analyze.
- SharePoint Online sites and document libraries
- Microsoft Teams and their connected content locations
- OneDrive accounts and drive access state
- Accessible, denied and unverified evidence
- Basic recommended flow and Advanced workload controls
- Explicit workload, location and library target selection
Inventory & scope
From broad discovery to precise targets
Accessible
Validated delegated access for the selected location.
Denied
A read probe returned access denial evidence.
Unverified
Access could not be established from the available evidence.
Professional temporary access: for selected SharePoint sites, DDC Guardian can track temporary Site Collection Administrator grants made for the technical account. Revocation is scoped to active grants recorded by DDC Guardian; it does not remove independently managed pre-existing rights.
Security & architecture
Local by design
Application processing runs locally while Microsoft 365 data is accessed through authenticated Microsoft APIs.
- Windows desktop workspace with the interface hosted in Edge WebView2
- Local gateway, application runtime and SQLite operational state
- Microsoft sign-in in the system browser for authentication and MFA
- Desktop public client using authorization code with PKCE
- Delegated Microsoft Graph permissions—no desktop client secret
- Local token-cache key protected for the current Windows user with DPAPI
Your password stays with Microsoft. DDC Guardian does not ask for or store a Microsoft 365 password.
Read the security architectureWindows device — local DDC workspace
WebView2Desktop interface
Local servicesGateway, runtime, SQLite
System browserMicrosoft sign-in + MFA
Microsoft EntraAuthorization code + PKCE
Delegated tokenCustomer-owned public client
Microsoft GraphSharePoint · Teams · OneDrive
Editions
Start useful. Add governed operations when needed.
Community is a functional read-only and dry-run edition. Professional adds persistent configuration and controlled advanced operations; it does not silently enable writes.
DDC Guardian Community
No pricing published
- Discovery, monitoring and inventory
- Classification recommendations in preview / dry-run
- Discovery capability assessment
- Dashboard, reporting and local audit
- Dynamic site and label reports
- Session-only target selection
DDC Guardian Professional
Contact CloudSyncDev
- Everything in Community
- Persistent scopes, mappings and settings
- Controlled custom metadata write-back
- Review and remediation workflows
- Purview readiness matrix
- Supported sensitivity-label operations with safeguards
No final public pricing, SLA or automatic write entitlement is claimed. Professional operations remain subject to delegated scopes, runtime evidence, explicit enablement, safeguards and approval.
Ready to assess the estate?
See what DDC Guardian can discover in your Microsoft 365 environment.
Review the verified workflow, prepare a customer-owned Microsoft Entra public client and begin with Community discovery and dry-run.