STAR Assessment

Organization Consent

Your organization's Global Administrator approves the Refoundry STAR Discovery app and its requested permissions in Microsoft Entra.

Microsoft identifies your organization during sign-in. Review the organization and permissions before approving.

This creates the enterprise application in your tenant if it is not already present. Consent does not start an assessment.

Discovery is a separate step

A later, on-demand run is performed by either your organization's Global Reader or a Refoundry B2B guest with Global Reader in your tenant.

The reader signs in separately. Azure Reader and workload-specific access are confirmed before collection.

Permissions and data handling

The discovery engine reads identity and security settings, licensing, device posture, collaboration and compliance configuration, and available Azure and Power Platform inventory. Microsoft displays the app's requested permissions before you approve.

Some Microsoft APIs use broad delegated permissions. Discovery remains limited to read-only collection operations and the signed-in reader's access. Granting consent does not assign that reader any roles.

This page exchanges no tokens and collects no assessment evidence. Later discovery runs save snapshots and reports locally. Any copies shared with Refoundry are deleted 30 days after engagement close; client-held copies remain under the client's control.

During discovery, public email-domain DNS records are queried through Cloudflare using domain names only, without Microsoft tokens.