AIRM runs a read-only, agentless assessment through the Microsoft Graph API, a full inventory of every AI agent, Copilot, service principal and non-human identity, with a scored NHI Risk report. We recommend a Global Admin completes the one-time connection.
AIRM is a platform, not a one-click scan from this website. You create an account, add a client tenant and approve read-only access; AIRM does the rest. If it finds risk, you act on it with a local Sabiki partner (your existing IT provider if you have one).
Create your free Sabiki platform account, no credit card.
Inside the platform, add the Microsoft 365 tenant you want to assess.
Approve read-only Microsoft Graph access. We recommend a Global Admin completes this one-time connection, it’s GDAP-compatible and agentless, and AIRM can’t change anything.
It inventories every AI agent, Copilot, service principal and non-human identity, about 60 minutes.
Your NHI Risk Score, findings and blast-radius, within 24 hours.
If it finds risk, remediate with a local Sabiki partner (your existing IT provider if you have one) and, if you want, move to continuous monitoring.
Delegated, read-only Microsoft Graph scopes, inventory only, no changes. A Global Admin is recommended to approve the connection.
| Permission | Why | Access |
|---|---|---|
Directory.Read.All | List users, apps & service principals (the non-human identities) | READ |
Application.Read.All | See app registrations, agents & their granted scopes | READ |
AuditLog.Read.All | Spot stale / unused credentials | READ |
| Finding | Detail | Sev |
|---|---|---|
| Agent with mailbox + app-management rights | Mail.ReadWrite + Application.ReadWrite.All | CRITICAL |
| Service principal, credential 2.3 yrs old | Never rotated; owner left the company | CRITICAL |
| 14 app registrations, no owner | Orphaned after past integrations | HIGH |
Discovery is a point-in-time snapshot. Behavioural signals & anomaly detection activate with AIRM Continuous (after a 7-day baseline).
The same knowledge base powers the Ask AIRM assistant (bottom-right).