There are two ways to buy visibility into your Microsoft 365 tenant. You can subscribe to a governance portal - a platform that plugs into your tenant and shows you dashboards for as long as you keep paying. Or you can commission an assessment - a point-in-time look, read-only apart from one change you approve and we remove, that hands you a report you own outright. Both have their place. Most of the market only sells you the first, so here is the honest version of the trade-off.
What a portal is really selling
A governance SaaS portal is, underneath the features, three things: a standing connection into your tenant, your data living in their cloud, and a recurring bill that continues for as long as you want to keep looking. That is a reasonable model for some problems. But it means the visibility is rented, not owned - stop paying and the dashboards, the history and the insight go dark. The value never accrues to you; it accrues to the subscription.
What a report gives you instead
An assessment inverts every one of those. Access is temporary, and read-only apart from one change you approve - granted for the run, and removed, change and all, when it is done. Your working data stays on the assessor's own machine. The delivered copy is held in the assessor's own Microsoft 365 tenant, not in any third-party assessment product or shared platform, and is removed by a scheduled sweep once it is more than thirty days old (by default), or at once on request, and everything is deleted on written request. And the deliverable is a self-contained report you keep for good - the permission map, the findings, the priority fixes, all in a file that is yours. No login, no seat count, nothing to cancel.
The honesty problem with an always-on score
A portal has a commercial reason to always have something to show you. That pressure leaks into the scoring: blunt numbers that move just enough to justify the renewal, checklists padded to look busy, features marked against you whether or not your licence includes them. A point-in-time assessment has no renewal to protect. It can afford to tell you that most of your posture is genuinely fine and hand you the short list of things that are not.
When a portal genuinely is the right answer
We would rather be straight with you than pretend otherwise. A subscription platform earns its keep when you need continuous enforcement rather than a periodic look - automated remediation, real-time alerting, policy that blocks a bad share the moment it happens. If you are a large enterprise with a dedicated governance team watching a live console every day, that is a portal's job, and you should buy one.
Most organisations are not that. They need to know where they stand, fix the handful of things that matter, and check again periodically - not pay a per-tenant subscription in perpetuity for a dashboard nobody opens.
The middle ground: a light retainer
If you do want to track drift over time, you do not need a portal to do it. A quarterly retainer re-runs the assessment on a schedule and keeps your prior reports so you can measure improvement - the same own-your-data model, just repeated. Between cycles the read-only assessment application stays approved, with its read-only Global Reader role, because the scheduled quarterly run needs it; the SharePoint sign-in application, the engagement account and the site collection administrator additions are set up and removed again each cycle, and the stages that need a signed-in administrator run attended. You get the trend line without a portal.
A dashboard you rent, or a report you own. For most Microsoft 365 tenants, the report is the honest answer - cheaper, cleaner, and yours to keep.
See it on your own tenant
Get the permission map for your Microsoft 365.
An assessment, read-only apart from one change you approve and we remove, scored honestly, and delivered as a self-contained report you own. Start with a free Copilot-readiness health-check, or request a full assessment.