Public client
The customer registers a Microsoft Entra Mobile and desktop application. The desktop flow does not accept or distribute a client secret.
Security & architecture
Local by design. Delegated by default.
DDC Guardian 365 is a Windows desktop application. Its interface, local services and operational state run on the device, while Microsoft identity and Microsoft 365 data access use authenticated Microsoft endpoints.
Desktop architecture
A private Windows workspace
The packaged application opens its local interface in Edge WebView2. A loopback-only gateway and application runtime serve that interface on the device.
- Windows 10/11 x64 desktop build
- Edge WebView2 desktop shell
- Local gateway bound to loopback
- Local Streamlit application runtime
- Local SQLite operational database
- Per-user mutable data under the Windows local application-data directory
Device boundary
WebView2Desktop user interface
Local gatewayLoopback session handoff
Application runtimeDiscovery, analysis, review
SQLite + cacheLocal operational state
System browserMicrosoft sign-in and MFA
Microsoft endpointsEntra + Microsoft Graph
Microsoft identity
Your password stays with Microsoft.
DDC Guardian uses Microsoft sign-in, delegated permissions and PKCE. It is designed without application client secrets for desktop authentication.
Authorization code
Sign-in begins from the local workspace and opens the system browser so Microsoft can handle identity, MFA and Conditional Access.
PKCE
A proof key binds the single-use authorization flow. Tokens and session identifiers are not placed into public callback URLs.
Delegated Graph
Microsoft Graph calls run in the context of the authorized customer-managed account and its granted delegated permissions.
Conditional Access remains authoritative.
DDC Guardian does not bypass MFA, relax Microsoft Entra policies or automatically create exclusions. Sign-in succeeds only when the customer's identity configuration allows it.
Least privilege
Permission needs follow the operation
The current first-run guidance uses delegated baseline Microsoft Graph permissions for identity and read access.
User.Read
Sites.Read.All
Files.Read.All
Group.Read.All
Directory.Read.All
Tenant admin consent may be required according to Microsoft Entra policy. A SharePoint Administrator role is proposed for full SharePoint catalog discovery, but customers should validate every role against their own policy.
Read path
Discovery, analysis and review
Community relies on read-oriented delegated permissions and dry-run. Permission Advisor never issues Graph write requests.
Write path
Separate Professional prerequisites
Supported metadata or sensitivity-label operations require Professional, appropriate delegated write scopes, runtime evidence, explicit feature enablement, safeguards, confirmation and approval.
Prohibited fallback
No application permissions
The current desktop/scanner security contract does not use application permissions, client credentials or an app-only fallback.
Local processing & storage
Local does not mean offline
Application processing runs locally while Microsoft 365 data is accessed through authenticated Microsoft APIs. Network traffic to Microsoft identity, Microsoft Graph and configured licensing/revocation endpoints can still occur.
Per-user data directory
Runtime configuration, SQLite state, encrypted token cache material and diagnostic logs are stored below the current Windows user's local application-data directory, outside the installation folder.
Protected token-cache key
In desktop mode, the Fernet key used for the delegated token cache is generated locally and protected with Windows DPAPI for the current user.
Sanitized diagnostics
Rotating local logs redact token, cookie, session, secret and PKCE-verifier values. Administrators should still review and sanitize diagnostics before sharing them with support.
Do not synchronize the DDC data directory to OneDrive.
The current product documentation directs administrators to keep mutable configuration, DPAPI material, runtime SQLite, token cache and logs in the local Windows data directory.
Professional safeguard chain
Fail closed until evidence is present
- Professional entitlement is valid.
- The technical account is connected through delegated PKCE.
- The required delegated permission is present.
- Runtime capability evidence is recorded.
- The operation is explicitly enabled.
- Scope and preview are reviewed.
- Confirmation and approval complete.
- The result is verified and audited.
Governed operations
Professional does not silently unlock writes
License gating is one control, not the only control.
- Custom metadata write-back supports preview, approval, apply, verification and audit
- User-applied labels are preserved by default
- Write-back is disabled by default
- Initial-pilot safeguards remain available for limited validation
- Sensitivity-label operations require protected-API readiness and a separate enable switch
- Unsupported delegated operations stop without app-only fallback
Tracked temporary SharePoint access
Grant narrowly. Track explicitly. Revoke only what DDC recorded.
When an authorized SharePoint Administrator chooses the Professional temporary-access workflow, DDC Guardian can use interactive modern authentication to set the technical account as Site Collection Administrator on selected sites.
- Targets must come from the current SharePoint catalog
- Only denied or unverified selected sites are eligible
- The operation requires explicit confirmation
- Grants are recorded with site, technical account, method and status
- Post-grant delegated access is reverified
- Revocation uses active DDC grant records and selected grant IDs
Pre-existing access is out of scope.
DDC Guardian must not revoke independently managed rights that were not granted and tracked by the product. If PowerShell or the SharePoint module is unavailable locally, DDC can generate a script for an appropriate administrative host; the outcome still requires reverification.
Assurance boundaries
Precise claims, no invented certifications
Security is described from the current implementation and its validation evidence.
Microsoft identity and Microsoft Graph necessarily involve network communication.
Compatibility with Microsoft technologies is not a Microsoft certification or endorsement.
This site does not claim Zero Trust certification or compliance with a named standard.
Never send passwords, access tokens, client secrets or raw authentication responses.
Purview auto-label policy management is not implemented in the current delegated-only model.
The product does not automatically move files between Microsoft 365 locations.
Prepare safely