What a discovery report contains.

2026-10-20 · TenantFlex

Discovery is the first thing TenantFlex does with a tenant, and the only thing it does until you approve more. It connects with one read permission, reads every SAML and OAuth/OIDC application, and reports what it finds before anything moves. The report is yours whether or not you migrate.

The real count

Every application and service principal, with its sign-on configuration, redirect URIs, assignments, certificates and secret expiry. In our experience, a tenant that "has four hundred integrations" has about a hundred and forty that are federated and in use, and that is the number the rest of the plan is built on.

A band for every application

Each application is banded as straightforward, needs review or manual work. Claims that use transformations, expressions or attributes the destination does not have are reported as complex, so they are reviewed before anything moves. Together the bands size the whole migration before it starts.

Who owns what

The report lists the owners, so the people who will repoint each application are known before the first wave is planned.

What is really used

With the optional sign-in log permission, the report shows when each application was last signed in to. Applications nobody uses are candidates for retirement rather than migration, and every one retired is one less owner to coordinate.

What expires, and when

Certificates and client secrets are listed with their expiry dates. The credential expiry list is useful on day one, whatever you decide to do next.

Reported, not moved

User and group assignments, conditional access or sign-on policies, and SCIM provisioning are read and shown in discovery, so each owner can recreate them deliberately rather than find out at cutover.

What it costs you

An afternoon and one read-only connection. Nothing is written to the tenant, and nothing migrates until you approve it.