Understand what you’re exposed to.
Monokel connects security observations across identities, applications, devices, email, sharing and external exposure — and explains the exposure that individual tools cannot show on their own.
- Microsoft 365Entra ID · Intune · SharePoint · Exchange
- External signalsDNS · TLS · email authentication
- AzureIn development
- Google WorkspacePlanned
- Data source
- Identity
- Applications
- Devices
- Sharing
- External exposure
- Cloudwith Azure
- ExposureWhat is exposed, and why it matters.
- ContextHow conditions relate across domains.
- ChangeWhat changed between observations.
Your tools see pieces. Exposure exists between them.
Every admin console is accurate about its own part of the environment. None of them is asked what the parts mean together — so the exposure that sits between them goes unexplained.
Monokel keeps each observation as evidence, relates it to the same applications, identities and resources, and explains what it means — including where the evidence stops.
Providers are data sources. Domains are how Monokel structures what it learns.
Evidence enters as observations — each tied to where and when it was seen. Monokel organises them by security domain, not by vendor, and draws conclusions only from what was observed.
Read-only connections to the systems that hold the controls.
- Microsoft 365Entra ID · SharePoint & OneDrive · Exchange Online · Intune
- DNS · TLS · email authentication
- Defender for EndpointOn request
- AzureIn development
- Google WorkspacePlanned
What was seen, where, and when. Kept as it was captured — never edited afterwards.
- Anyone-link without expiry on /sites/financeobserved 29 Sep 06:10
- Application permission granted with admin consentobserved 29 Sep 06:10
- Mailbox forwards to an external addressobserved 29 Sep 06:10
- Device compliance: not observedcoverage incomplete
One vocabulary for the environment, whichever provider the evidence came from.
- Identities
- Applications
- File sharing
- Devices
- External exposure
- CloudWith Azure
Findings and situations that state why they exist, how certain they are, and where the control lives.
- Findingsone pattern, one finding
- Situationsconditions that coincide
- Changebetween observations
- Unknownwhere evidence stops
Build a picture of the environment from the systems that are authoritative for it — read-only, time-stamped, reproducible.
Relate observations to the same applications, identities and resources, across sources and domains.
Explain what matters, the evidence behind it, what changed — and what cannot be established.
Signals make more sense together.
An application with far-reaching permissions is common. So is an application with a configured surface. When both concentrate on the same application, the exposure is different — and Monokel describes it as one situation, with the evidence for each part.
- Why it matters
- When privileged access and an exposed surface coincide in the same application, a single weakness can carry further than either part on its own.
- How certain we are
- 2 confirmed observations. Reliability of the observations: high. Coverage complete within the access Monokel has been granted.
- What we do not know
- The concentration is the significance — not a claim of reachability, exploitability or compromise.
- Evidence
- The permission grant and the application registration, each with the time it was observed.
- Where change happens
- Microsoft Entra. Permissions and application surfaces are managed there. Monokel points there — change happens there.
Situation view, with the product’s own wording. Illustrative data.
The model is built to follow one object across providers. As Azure coverage is added, an application can be read together with the subscriptions it controls and the resources inside them. This is in development and not yet available to customers.
- Microsoft 365Application holds privileged permissions
- AzureThe same application holds a subscription role
- Azure resourceThe subscription contains an internet-exposed resource
- UnderstandingOne application reaches two control planes
In development. Not yet available to customers.
A coherent picture of the environment — not a stream of alerts.
The Environment view is where Monokel starts. It answers four questions in the same order every time — and a count opens the list behind it.
The Environment view. Illustrative organisation and data.
- 01What has changed
Differences from the previous published state, marked as worsened, improved or with no simple direction.
- 02What coincides
Conditions that concentrate on the same object, described as one situation rather than separate signals.
- 03Exposure we observe
Types of exposure, each with the list behind the number and an explanation of why it matters.
- 04What we can’t see yet
Areas where evidence is incomplete. Shown as insufficient visibility — never as a clean result.
Anyone in the organisation can open these items. Access this broad is rarely intended, and seldom noticed once it has been granted.
High. Sharing links observed within the access Monokel has been granted.
- Board pack Q3.pptx/sites/finance · organisation-wide link
- Salaries 2026.xlsx/sites/hr · organisation-wide link
- Customer contracts/sites/sales · folder · organisation-wide link
- Show the 214 shared items →
Whether each link is still needed. That is known inside your organisation, not in the evidence.
Change the default link type, or remove links, in the SharePoint admin center.
An exposure opened from the Environment view. Illustrative data.
A finding is a conclusion, with its reasoning attached.
Observations are evidence. A finding is what Monokel concludes from them — stated with why it matters, how certain it is, the evidence behind it and where the control lives.
- 01What is happening37 shared items are reachable through anyone-links that never expire.
- 02Why it mattersAnyone who has the link can open the content, with no sign-in and no end date. Access outlives the reason it was given.
- 03How certain we areHigh. Sharing links and tenant sharing settings were observed within the access Monokel has been granted.
- 04Evidence
29 Sep 06:10Sharing links on 9 sites29 Sep 06:10Tenant setting: anyone-links allowed, no default expiry
- 05What changed+4 shared items since the previous observation on 26 Sep.
- 06What you can doSet a default expiry for anyone-links, or restrict them to specific sites.
- 07Where to do itSharePoint admin center → Policies → Sharing
A finding, set out in the order Monokel explains exposure. Illustrative data.
- One pattern, one finding
A condition affecting 27 applications is one finding with 27 affected applications — not 27 separate alerts.
- Observations are not findings
A provider’s alert or score enters Monokel as an observation. Conclusions, and their severity, come from Monokel’s own evaluation.
- Severity means the same everywhere
Critical, High, Medium and Low carry one meaning across every domain, so findings can be compared.
- Action happens in the control plane
Each finding names where the control lives — Entra, Intune, Defender, SharePoint, your DNS provider. Monokel explains; the change is made there.
What changed?
Monokel compares observations over time. Every change is anchored to the evidence on both sides of it — so the history stays explainable, and a lost signal never reads as an improvement.
- Applications · ImprovedAn unused application credential was removed
- Email · ImprovedDMARC policy published for aldervik.se
- Applications · WorsenedAn application was granted broader API permissions
- Identities · WorsenedAn administrator account was excluded from the MFA requirement
- File sharing · WorsenedFour new anyone-links without expiry
- Devices · Visibility changeDevice compliance could not be fully observed. Devices shows insufficient visibility — not its last known state.
Change between observations. Illustrative data.
Knowing what you don’t know is part of the answer.
Monokel separates observed safety from missing evidence. Three states, stated plainly — and Unknown is one of them.
Supported by evidence. Monokel observed the control and can show what it saw.
Something observed creates exposure. Stated with its reasoning and evidence, so it can be judged.
Not enough evidence for a claim — and Monokel says so. Missing data never becomes a green check.
Every finding points to the observations that produced it, and can be explained from them.
Conclusions are drawn from captured observations, each with the time it was observed — not from assumed live state.
Conclusions are designed to be reproducible from stored evidence: derived without randomness or hidden state, so the same evidence is meant to lead to the same conclusion.
Partial, failed or missing coverage is carried through as Unknown. Losing evidence never improves the picture.
The platform is built with each organisation as its own boundary: evidence is scoped to one environment and is not designed to be evaluated together with another’s.
Monokel reads configuration and security state. It never changes anything in the environments it observes.
Unknown is preferable to pretending evidence exists.
Where the evidence comes from.
Microsoft 365 is the deepest source today. Each source feeds domains in the same model, so a new provider adds evidence — not a new product.
| Source | What Monokel observes | Feeds | Status |
|---|---|---|---|
| Microsoft Entra ID | Identities, sign-in policies, privileged roles, applications and their permissions | IdentitiesApplications | Available |
| SharePoint & OneDrive | Sharing links, external access and tenant sharing settings | File sharing | Available |
| Exchange Online | Mailbox settings such as external forwarding | Email | Available |
| Microsoft Intune | Device management and compliance | Devices | Available |
| Microsoft Defender for Endpoint | Endpoint protection signals, connected separately with its own consent | Devices | |
| DNS · TLS · email authentication | How your domains appear from the outside — SPF, DKIM, DMARC, certificates and protocols | External exposureEmail | Available |
| Microsoft Azure | Subscriptions, roles and resources — and how they relate to identities and applications | CloudApplicationsIdentities | |
| Google Workspace | Identities and collaboration | IdentitiesFile sharing |
Monokel is not tied to one vendor. Sources are added deliberately, and only described as available once customers can use them.
Many environments. One way of understanding them.
Every customer environment is described with the same model — the same domains, the same severity, the same Unknown. Compare customers without rebuilding the picture tenant by tenant.
- 01Every customer, described the same way
- 02See where exposure, change or limited visibility sits
- 03Open one customer and read the full environment
| Customer | What Monokel sees | Change | Visibility |
|---|---|---|---|
| Aldervik AB | Active exposure in 4 areas | Worsened | Incomplete in 1 area |
| Norrsten Logistik | Active exposure in 2 areas | Improved | Complete within granted access |
| Kvarnby Tandvård | Nothing active observed | No change | Complete within granted access |
| Fjällhed Fastigheter | Exposure unknown | No simple direction | Incomplete in 3 areas |
| Brisa Konsult | Active exposure in 1 area | Worsened | Complete within granted access |
Portfolio view for MSPs. Illustrative customers and data.
Frequently asked.
What access does Monokel need?
Read-only. Monokel reads configuration and security state through read-only permissions and never modifies anything. There are no agents to install.
Is Monokel a SIEM, a CSPM or a vulnerability scanner?
No. Monokel does not collect event streams, raise alerts or scan for vulnerabilities, and it has no ticketing. It builds an explained description of exposure from configuration and security state, and points to the system where each control is changed.
Does Monokel fix issues for me?
No — deliberately. Changes happen in the systems that own the controls: Microsoft Entra, Intune, Defender, SharePoint, your DNS provider. Monokel explains what you are exposed to, why it matters and where the control lives.
Is Monokel only for Microsoft 365?
Microsoft 365 is the deepest source today — Entra ID, SharePoint, OneDrive, Exchange Online and Intune, with Defender for Endpoint on request — alongside the external exposure of your domains. Azure is in development and Google Workspace is planned. The model is not tied to one vendor.
How is this different from Microsoft Secure Score?
Secure Score measures configuration against Microsoft’s recommendations, product by product. Monokel describes exposure: what was observed, how conditions relate, why it matters, what changed — and what cannot currently be established.
What happens when Monokel can’t verify something?
It says so. Where evidence is missing, partial or out of reach, Monokel shows Unknown rather than assuming safety. Losing evidence never improves the picture.
Do I need a security background to use it?
No. Every finding explains what is happening, why it matters, how certain it is and where to act, in plain language. The evidence is there when you want the detail.
How do we get started?
Onboarding is by invitation. Book a call, and we connect your environment with read-only consent and walk through what the evidence shows.
See your environment the way Monokel reads it.
Connect read-only, and look at what the evidence shows — and where it stops.
- 01Connect. Grant read-only consent. Nothing to install.
- 02Observe. Monokel captures what the connected sources show, and when.
- 03Understand. Read exposure, change and uncertainty, with the evidence behind each.