There are two ways to buy visibility into your Microsoft 365 tenant. You can subscribe to a governance portal - a platform that plugs into your tenant and shows you dashboards for as long as you keep paying. Or you can commission an assessment - a point-in-time read-only look that hands you a report you own outright. Both have their place. Most of the market only sells you the first, so here is the honest version of the trade-off.
What a portal is really selling
A governance SaaS portal is, underneath the features, three things: a standing connection into your tenant, your data living in their cloud, and a recurring bill that continues for as long as you want to keep looking. That is a reasonable model for some problems. But it means the visibility is rented, not owned - stop paying and the dashboards, the history and the insight go dark. The value never accrues to you; it accrues to the subscription.
What a report gives you instead
An assessment inverts every one of those. Access is read-only and temporary - granted for the run, revoked when it is done. Your data does not take up long-term residence anywhere: a single run is purged within 30 days. And the deliverable is a self-contained report you keep for good - the permission map, the findings, the priority fixes, all in a file that is yours. No login, no seat count, nothing to cancel.
The honesty problem with an always-on score
A portal has a commercial reason to always have something to show you. That pressure leaks into the scoring: blunt numbers that move just enough to justify the renewal, checklists padded to look busy, features marked against you whether or not your licence includes them. A point-in-time assessment has no renewal to protect. It can afford to tell you that most of your posture is genuinely fine and hand you the short list of things that are not.
When a portal genuinely is the right answer
We would rather be straight with you than pretend otherwise. A subscription platform earns its keep when you need continuous enforcement rather than a periodic look - automated remediation, real-time alerting, policy that blocks a bad share the moment it happens. If you are a large enterprise with a dedicated governance team watching a live console every day, that is a portal's job, and you should buy one.
Most organisations are not that. They need to know where they stand, fix the handful of things that matter, and check again periodically - not pay a per-tenant subscription in perpetuity for a dashboard nobody opens.
The middle ground: a light retainer
If you do want to track drift over time, you do not need a portal to do it. A quarterly retainer re-runs the assessment on a schedule and keeps your prior reports so you can measure improvement - the same read-only, own-your-data model, just repeated. You get the trend line without handing anyone a standing key to your tenant.
A dashboard you rent, or a report you own. For most Microsoft 365 tenants, the report is the honest answer - cheaper, cleaner, and yours to keep.
See it on your own tenant
Get the permission map for your Microsoft 365.
A read-only assessment, scored honestly, delivered as a self-contained report you own. Start with a free Copilot-readiness health-check, or request a full assessment.