Basic
Recommended inventory workflow
Refresh all supported workloads, keep the last good snapshot if one source fails, then refine the selection. Target selectors start empty so broad analysis is not accidental.
Verified product capabilities
From discovery to governed action
DDC Guardian 365 connects Microsoft 365 inventory, content analysis, risk review, classification recommendations, permission evidence, reports and controlled operations in one local Windows workspace.
Discovery & inventory
Build a trusted Microsoft 365 inventory
Inventory what the delegated technical account can validate instead of treating a single search response as complete tenant coverage.
- SharePoint tenant catalog discovery with delegated validation
- Microsoft Teams discovery and connected root-site/library validation
- OneDrive user and drive access assessment
- Accessible, denied and unverified status evidence
- Last-known-good snapshot behavior when a source cannot refresh
- Workload, location and document-library target selection
Advanced
Workload-level controls
Use per-workload refresh, diagnostics, explicit modes and precise selection controls when investigation or tenant operations require additional detail.
Professional · SharePoint
Tracked temporary access
For denied or unverified SharePoint sites, an authorized administrator can explicitly grant the technical account temporary Site Collection Administrator access, reverify it and later revoke active grants tracked by DDC Guardian. A PowerShell script fallback is available when the local host lacks the required module.
Content analysis
Analyze selected content with safe defaults
Discovery establishes the target. Analysis processes the selected SharePoint, Teams and OneDrive content and records results for review. Dry-run is the product default.
Incremental analysis
Use the current inventory and target selection to process the relevant content. Advanced controls retain scan-mode and detailed selection options.
Risk signals
Review risk scores and high/medium/low distributions, then navigate from the dashboard into matching document results.
Classification recommendations
Extract supported content, evaluate configured rules and mappings, and propose classification or metadata values without changing Microsoft 365 in preview or dry-run.
Content coverage has practical boundaries.
Analysis depends on delegated access, target selection, supported file extraction and Microsoft API responses. DDC Guardian surfaces failures and skipped items rather than claiming universal coverage.
Premium overview
Four signals, three views
Documents analyzed
Current result volume.
Need attention
Evidence that warrants review.
Coverage
Validated discovery status.
Recommendations
Suggested next actions.
Interactive Coverage, Risk and Classification views route to filtered Discovery or Results experiences.
Review
Move from summary to evidence
Search and filter analyzed documents, inspect exact locations and understand why a result needs attention before deciding what happens next.
- Results explorer with file, workload, location and recommendation context
- Basic filters for Search, Risk, Recommendation and Location
- Advanced filters for deeper operational review
- Existing label/source context where available
- Human remediation locations preserved in dynamic reports
- Approval boundary maintained before write operations
Metadata & classification
Preview first. Apply only with safeguards.
Community can review recommendations and simulate metadata plans. Professional adds controlled writes but does not bypass the service-level gates.
Community
Preview / simulation
Use current Discovery and Analyze selections and the latest per-file results to inspect proposed metadata outcomes without modifying Microsoft 365.
Professional
Custom metadata write-back
Preview, approve, apply, verify and audit supported custom metadata changes. Delegated write permissions, enablement, safeguards and explicit confirmation are required.
Professional
Sensitivity-label boundary
Assess Purview readiness and use supported delegated sensitivity-label operations only after runtime validation and protected-API prerequisites. DDC Guardian does not implement Purview auto-label policy management.
Permissions
Review access without silently changing it
The Permission Advisor is a read-only diagnosis service. It correlates denied SharePoint locations with available Teams or Microsoft 365 Group relationships and proposes narrow remediation for a human administrator.
- Accessible, need-attention and unverified access health
- Read-only delegated Microsoft Graph evidence
- Teams, group, channel and SharePoint relationship context where found
- Sanitized error evidence instead of raw authentication responses
- Least-privilege remediation proposals
- No automatic permission change from the advisor
Important distinction
Advice is not proof of the ACL cause
An HTTP 401/403 confirms that a delegated probe was denied; it does not by itself prove the exact group membership, policy or ACL responsible. DDC Guardian keeps this uncertainty visible.
Temporary SharePoint access is separate.
That Professional workflow requires the authorized SharePoint Administrator, explicit target selection, confirmation and tracked grant records.
Reports & audit
Keep findings usable
DDC Guardian stores operational results locally and produces report views and exports that support review and human remediation.
Site and label reports
Dynamic views connect sites, recommended labels, risk and exact locations. Available in Community and Professional.
Results exports
Current product code supports structured result exports, including CSV, XLSX and JSON paths, subject to the data available in the local workspace.
Local audit trail
Record licensing, discovery, reporting and governed operation events so administrators can review product activity without claiming an external compliance certification.
Product boundaries
Clear about what DDC Guardian does not claim
The current implementation is deliberately fail-closed around unsupported or unverified operations.
The product does not automatically move documents between Microsoft 365 locations.
The desktop and scanner model is delegated-only. Application permissions and client credentials are not used as a fallback.
Readiness can be assessed, but creation, enablement or modification of Purview auto-labeling policies is not implemented.
Professional does not automatically enable write-back. Required scopes, runtime evidence, switches, safeguards and approval still apply.
No Microsoft certification, Zero Trust certification or standards compliance claim is made on this website.
Coverage is based on validated delegated evidence and may be partial, denied or unverified.
Choose the right operating model