I got tired of opening the same five compliance screens in 15 different tenants.

At Tegria I supported a handful of hospital and clinic environments on Microsoft 365. Each had drifted to a different security posture. My manager needed a snapshot: which tenants enforce MFA, which still allow legacy auth, which have Conditional Access that does real work. By hand that task takes a morning per tenant.

You can ask Graph instead. I wrote a small tool to do that.

The tool

• You authenticate to each tenant through Microsoft Graph.
• You check settings that map to CIS: MFA registration, Conditional Access policies, legacy auth blocks, risky sign-in handling, and admin consent.
• You compare each tenant to the CIS baseline and flag gaps.
• You generate one HTML report, one row per tenant. The report respects licenses, so you do not flag a missing P2 feature on a P1 tenant.

You send one file. You skip the portal.

Graph instead of the portal

The portal hides what does not exist. If a tenant lacks a setting, you see nothing. Graph returns what you configured, including defaults the portal tucks away behind a label. You run the same check in every tenant, each time, with a script.

This snippet shows the shape:

# pseudo - sanitized
$tenants | ForEach-Object {
  $policies = Invoke-GraphRequest -Tenant $_ -Endpoint "identity/conditionalAccess/policies"
  $mfa = Invoke-GraphRequest -Tenant $_ -Endpoint "reports/credentialUserRegistrationDetails"
  Compare-AgainstCIS -Policies $policies -Mfa $mfa -License $_.sku
} | Export-HtmlDashboard -Out report.html

The Graph calls took little work. I spent most time in Compare-AgainstCIS. You decide what counts as a fail when licenses differ. You treat a P1 tenant without Identity Protection different from a P2 tenant without it.

Result

• You assess ~15 tenants with one method, not 15 clipboards.
• You cut review from hours to minutes. You refresh Graph and you refresh the report.
• You give your team one view of what each tenant needs, not a stack of screenshots.

Takeaway

I built a tool this time instead of clicking through portals. The code loops over tenants and writes HTML. That loop taught me to fix the process, not repeat it.

You run a small MSP or a multi-tenant helpdesk and you still check by hand, start with one check. Pull MFA registration and add one check per week. Build the dashboard later.

Built and tested at Tegria against a subset of Tegria client environments. ~15 tenants, CIS benchmarks, license-aware HTML.