Operate DDC Guardian with clear boundaries

01

Getting started

Use an approved DDC Guardian 365 build supplied by CloudSyncDev or your authorized distributor. The current Windows application is installed per user and opens a local WebView2 workspace.

1. Confirm that the Windows device and WebView2 runtime are ready.
2. Create a customer-owned Microsoft Entra public-client registration.
3. Configure the exact loopback redirect URIs and delegated Graph permissions.
4. Start DDC Guardian and complete the one-time Tenant ID and Application (client) ID setup.
5. Sign in through Microsoft, then connect the customer-managed technical account.
6. Run the discovery capability assessment and refresh the inventory.
7. Select exact targets and run an initial limited dry-run analysis.
8. Review results, permission findings, reports and recommendations.

02

System requirements

03

Microsoft Entra setup

Register the application as a Mobile and desktop / public client. Enable public-client flows. Do not create or distribute a client secret for desktop authentication.

Redirect URIs

Use the exact values expected by the current build. Do not derive redirect URIs from an arbitrary bind address or request header.

Baseline delegated Microsoft Graph permissions

Grant consent according to tenant policy. Professional writes use separate delegated write permissions and remain disabled until their additional prerequisites pass.

04

Authentication & PKCE

DDC Guardian uses the Microsoft identity platform desktop public-client model:

• The system browser handles Microsoft sign-in and MFA.
• Your password stays with Microsoft.
• The desktop application rejects a scanner client-secret configuration.
• The completed browser flow is returned to the original local session without placing access tokens or session IDs in URLs.
• Conditional Access remains authoritative.

05

Discovery

Discovery builds inventory for SharePoint Online, Microsoft Teams and OneDrive and records access evidence.

Coverage is evidence-based. A partial result does not become a tenant-wide completeness claim.

06

Target selection

Target selectors start empty. Choose workloads, locations and libraries explicitly. “All accessible” is selected only when the operator intentionally requests it.

• Basic mode emphasizes the recommended refresh-and-refine flow.
• Advanced mode exposes per-workload refresh, diagnostics and detailed selection controls.
• Community can use temporary session-only selections for dry-run.
• Professional can persist scopes and related configuration.

07

Analysis

Analysis uses the current target selection and local configuration to process Microsoft 365 content through delegated APIs.

• Dry-run is the default operating mode.
• Incremental analysis is the recommended starting mode.
• Supported content extraction feeds classification rules and mappings.
• Results can include classification recommendations, confidence, risk and metadata status.
• Skipped and failed items remain visible for review.

08

Review

The Overview dashboard shows Documents analyzed, Need attention, Coverage and Recommendations, plus three views: Coverage, Risk and Classification.

Use Review to search results, filter by risk, recommendation and location, inspect file context and navigate to the exact Microsoft 365 location when available. Empty workspaces show a next action instead of simulated product data.

09

Metadata

Community supports metadata preview and simulation. Professional adds controlled custom metadata write-back.

Professional safeguard sequence

1. Confirm the correct edition and tenant-bound license.
2. Confirm delegated authentication and required write scopes.
3. Enable the specific operation in configuration.
4. Review selected workloads, locations and result source.
5. Generate and review the plan.
6. Approve and explicitly confirm the operation.
7. Apply, verify and audit the outcome.

User-applied labels are preserved by default. Write-back remains disabled by default.

10

Permissions

Permission Advisor performs read-only diagnosis. It can connect denied SharePoint locations to available Teams, channel or Microsoft 365 Group evidence and recommend the narrowest human remediation.

The advisor does not automatically change group membership, site ACLs or OneDrive sharing. A denied HTTP response proves a denied probe, not the exact policy or ACL cause.

11

Reports

Dashboard, reporting, dynamic site/label reports and the local audit trail are available in both editions. Current result paths include structured export support for CSV, XLSX and JSON where the corresponding data is available.

Reports can preserve site, library, folder and document locations for human remediation. Review exports before external sharing because they may contain tenant content metadata.

12

Community edition

Community activates without a Professional key and remains useful for read-only Microsoft 365 work.

• Discovery, monitoring and inventory
• Classification recommendations in preview / dry-run
• Discovery capability assessment
• Dashboard, reports and audit
• Session-only configuration and target selection

Community cannot persist scopes, catalog choices, mappings or settings, and it cannot perform Microsoft 365 write-back or remediation workflows.

13

Professional edition

Professional is enabled through an offline-verifiable, tenant-bound signed license and adds persistent configuration and controlled operations.

• Persistent scopes, catalog choices, mappings, retention and settings
• Controlled custom metadata write-back
• Remediation workflows
• Purview readiness matrix
• Supported delegated sensitivity-label operations
• Auto-labeling readiness assessment (not policy management)

Professional does not automatically enable write-back or Purview operations.

14

Troubleshooting