Security model

Your sign-in, in your browser

The page runs entirely in your browser and makes every change with your own delegated sign-in to Microsoft Graph. Microsoft tokens stay in the tab. Andy Kemp Consulting's platform only records that your organisation is approved, and each step's progress; it never receives Microsoft tokens or tenant data.

Least privilege

• On connect it can only read: your directory and Windows 365.
• Write permissions are asked for at Deploy, for that tab only, and only the ones the design uses: Windows 365 always, groups only if it creates them, licences only if it licenses the group.
• It has no Azure Resource Manager permission at all.
• Review stops if a role you need isn't active, and tells you when you hold more than the job needs, so you can use just the roles you need through PIM next time.

What it changes

• It creates only the items listed on the Review page.
• A policy, user settings or group that already exists is kept as it is.
• Assigning adds the users group to a policy or settings; it never removes groups already assigned.
• People aren't local administrators of their Cloud PC unless you choose it.

Removing it

Windows 365 doesn't use W365 Deploy to run. Remove the deployer's access deletes the AKC W365 Deployer enterprise app from your tenant, with every permission you consented to it. You can also delete it yourself in Entra admin center > Enterprise applications.