Getting Started

Cindera is a Microsoft 365 identity security and compliance copilot built for small and mid-sized businesses. It reads the configuration of your Entra ID tenant (accounts, MFA registration, conditional access policies, app consents, admin roles) and translates the raw signals into plain-language findings with step-by-step remediation.

Think of Cindera as an external Microsoft security engineer for SMEs. Tenants ship with sensible-but-incomplete defaults, and most companies do not have the in-house expertise to know what is missing. Cindera does that legwork for you on every scan and tells you which two or three things actually matter this week.

Cindera is intentionally not a SIEM, a threat-detection tool, or a generic compliance checklist. It is focused on identity and access configuration, the layer where the majority of SME breaches start. NIS2, GDPR Article 32 evidence, and cyber-insurance readiness fall out of that focus as outputs.

Cindera runs in three steps. After the initial connect, the loop repeats on a nightly schedule and on-demand whenever you want a fresh picture.

1. Connect

A Global Administrator in your tenant grants Cindera read-only access to Microsoft Graph through Microsoft's standard admin-consent flow. The consent is granted to a dedicated Cindera application registration; no user-by-user prompts are involved later. Cindera never modifies anything in your environment.

2. Scan

The scanner pulls a focused slice of your directory (accounts, authentication methods, conditional access policies, app registrations, role assignments) and runs every Cindera rule against it. A typical scan finishes in about half a minute. You can watch progress live on the dashboard or close the tab and come back later.

3. Review

Each finding includes a plain-language explanation, the business impact, an estimated fix time, a direct link into the Microsoft 365 admin centre at the right page, and step-by-step instructions for whoever will actually do the work. Mark findings as resolved or assign them as tasks; the next scan re-checks automatically.

The first scan kicks off as soon as the admin consent flow returns. You will see a live progress card with the current rule running. Here is what to expect:

• Duration: usually about half a minute, occasionally up to two. Very large tenants (5,000+ accounts, dozens of conditional access policies) can take up to a minute.
• Data read: user objects, authentication-method registration, conditional access policies, directory roles, application registrations, service principals, and sign-in activity timestamps. Cindera requests the smallest possible shape of each object using Microsoft Graph $select.
• No writes: the scanner uses a read-only application identity. Nothing in your tenant is modified by the scan itself.
• Findings persist:at the end of the scan, results are written to Cindera's database (EU region) and your health score is recomputed.

The number on your dashboard is a weighted score out of 100. Every open finding carries a weight based on its severity:

1. Critical: weight 25. Things that put the tenant at immediate risk, such as an administrator without MFA.
2. High: weight 10. Configuration gaps that materially weaken your security posture.
3. Medium: weight 4. Hygiene issues that compound over time.
4. Low: weight 1. Minor improvements worth doing when convenient.
5. Info: no weight. Context only.

Those weights are added up, and the score falls as the total grows: it halves at a total of 50, halves again at 150, and so on. The first problem of a kind therefore costs more than the tenth, which matches what the tenth actually tells you. It tells you the problem is systemic, and you already knew that from the first.

The score floors at 0 and is calculated separately for the overall posture, the NIS2 view, and the GDPR view, so you can see at a glance which framework is dragging you down.

Score labels

• 80–100 · Healthy. The fundamentals are in place. Continue monitoring and stay on top of new findings as they appear.
• 60–79 · Needs attention. One or two material gaps that should be closed within the next sprint.
• 40–59 · At risk. Multiple identity issues stacking up. This is where most attackers find a way in. Prioritise critical and high findings this week.
• 0–39 · Critical. The tenant is materially exposed. Treat the critical findings as incidents and fix them before anything else.