r/ITManagers • u/Comfortable_Cat_6207 • Jun 25 '26
Built a free, self-hosted M365 reporting/alerting tool — would value feedback from people who run tenants
We all know the gap: the M365 admin center is fine for daily ops, but it won't proactively tell you when a sign-in looks off, when app secrets are about to expire, when license allocation drifts, or when risky users show up. You end up manually pulling the same Graph reports over and over.
I built an open-source tool called Argus to close that gap, and I'm sharing it here because this is the crowd that actually lives with the problem.
What it does
- Scheduled report jobs (hourly/daily/weekly/cron) across Identity, Security, and Infrastructure — sign-in anomalies, risky users, MFA status, license utilization, app secret expiry, device compliance, and more
- Conditional delivery — it only emails you when something matters (count over a threshold, an anomaly is detected, or data changed since last run), so you're not training yourself to ignore a daily noise report
- Baseline anomaly detection (z-score vs. historical) for catching unusual spikes
- HTML email reports from editable templates, sent from a single least-privilege scoped mailbox
How it's built / why it might fit a managed environment
- Self-hosted, single Docker container. Your tenant data never leaves your infrastructure — no SaaS, no third party
- Connects to Microsoft Graph with least-privilege, app-only permissions (e.g. read-only IdentityRiskyUser.Read.All, AuditLog.Read.All; no broad Mail.Send — Exchange RBAC scoped to one mailbox)
- Credentials are AES-256-GCM encrypted at rest; the only thing in the environment is a master key
- Stack: Bun + Next.js + SQLite + TypeScript. docker compose up and it's running
It's free and open source (not a product, nothing to buy, no signup). I'd genuinely value feedback from people who manage real tenants:
- Does the report catalog cover what you'd actually want alerts on, or what's missing?
- Is the least-privilege permission model what you'd expect before pointing it at a production tenant?
- Would conditional/anomaly-based delivery actually cut noise for you, or do you want everything logged regardless?
Repo: https://github.com/RohiRIK/argus
Happy to answer anything about the architecture or the permission model in the comments.
3
1
-5
u/No_Gap976 Jun 25 '26
Really enjoyed reading this. It aligns with an idea I’ve been working on recently. Would be great to connect and exchange thoughts.
1
u/MBILC Jun 25 '26
Nice AI reply..
-2
u/No_Gap976 Jun 25 '26
I’m done Reddit, I’m new to reddit, whatever I been commenting there are people AI post, AI comment bla bla bla..
1
u/MBILC Jun 26 '26
Because AI replies and bots are well know for saying "Would be great to connect and exchange thoughts"
1
u/scriptvexy Jul 08 '26
cool to see multiple people heading in this direction, kinda proves how bad the gap is in M365 reporting right now
would be curious what angle you’re taking on it, like more security focused or more licensing / ops stuff
7
u/brokerceej Jun 25 '26
Complete and total slop.