Connect your tenant
Sign in with your app registration, run the first collection and open the Overview dashboard.
Before you start, create your app registration and have its tenant ID and application (client) ID ready.
Sign in
Open Kairavo. Under Settings, select Tenants and sign-in.
Wait until Local database shows "The local database is ready."
Under Your app registration, enter the Tenant ID and the Application (client) ID. Both are GUIDs from the Overview page of your app registration.
Select Sign in with Microsoft. Your default browser opens the Microsoft sign-in page. Conditional Access and MFA apply as they do in the Intune admin center. Kairavo never shows a password field itself.
When the browser shows "Signed in to Kairavo", close the tab and return to Kairavo.
The tenant appears under Signed-in tenants. Select Test connection. Kairavo reads your organization name to confirm that it reached the right tenant.
Sign in with an account from the same tenant as the tenant ID. Kairavo refuses a sign-in to a different tenant.
Collection runs only for tenants with a valid license. Kairavo checks the license right after you sign in. If the tenant has none yet, it stays read-only until you activate your license. Collection then starts on its own.
The first collection
As soon as a signed-in tenant has a valid license, Kairavo starts the first collection. You do not have to wait for the next scheduled run.
Kairavo reads your tenant with your delegated permissions. It sees what your Intune role and scope tags allow. An admin with a scoped role collects only the scoped part of the tenant.
What gets collected
Depending on the permissions you granted, Kairavo collects:
- Managed devices, detected apps, Autopilot deployment events and Endpoint analytics
- Configuration profiles, Settings Catalog policies, administrative templates, endpoint security policies, compliance policies and Windows update profiles
- Apps, app protection policies and app configuration policies
- PowerShell scripts, macOS shell scripts and remediations
- Enrollment configurations, Autopilot profiles and registered identities
- Intune roles, scope tags and assignment filters
- Groups that policies and apps are assigned to, and their members
- Conditional Access policies, named locations, authentication strengths and the authentication methods policy
- Intune audit events and Entra directory audit events
- Subscribed licenses, Windows 365 Cloud PCs and Microsoft 365 service health
The full list of permissions is on Create your app registration.
How often
| Data | How often |
|---|---|
| Audit events | Every 5 minutes |
| Policies, apps, devices, groups and other entities | Every hour |
Collection runs while Kairavo is open or running in the tray. Closing the window keeps Kairavo running in the tray by default, so collection continues. You can change this under Preferences with Keep running in the tray and Launch at login.
Nothing runs while your computer sleeps or is turned off. When the computer wakes up, Kairavo collects right away.
When you need to sign in again
Background collection never opens a browser. When Kairavo cannot renew your sign-in, for example because a Conditional Access sign-in frequency applies, it shows a "Sign in required" notice and pauses collection for that tenant. Select Sign in again to continue.
The Overview dashboard
When a tenant is connected, select Back to workspace at the top of the sidebar. The workspace opens on Dashboards. On your first visit, Kairavo creates the Overview dashboard for the tenant.
The Overview dashboard shows:
| Tile | What it shows |
|---|---|
| Compliance | The share of compliant devices |
| Managed devices | The number of managed devices |
| Noncompliant devices | The number of noncompliant devices |
| Changes in 24 hours | Changes captured in the last 24 hours |
| Devices by OS | Devices per operating system |
| Compliance over time | Compliance at each collection |
| Last check-in | How recently devices checked in |
| Recent changes | The latest captured changes |
| Newest open alerts | Alerts that are still open |
Some tiles fill in over time:
- The first collection is a baseline. It is not counted as a change. Changes appear from the next collections onward.
- Trends need history. Compliance over time gains a point with each collection.
You can edit the Overview dashboard or build your own. See Dashboards.
Check collection coverage
The bottom of the workspace sidebar shows when the tenant was last collected, for example "Collected 5 min ago". Before the first collection finishes, it shows "Not collected yet".
Select it to open collection coverage. Each data source shows its status:
| Status | Meaning |
|---|---|
| healthy | The last run succeeded |
| collecting | A run is in progress |
| stale | The last successful run is too old |
| consent required | The app registration lacks the permission this source needs |
| unavailable | No run has been recorded for this source yet |
| error | The last run failed. The message says why |
If a source shows "consent required", add the permission to your app registration, grant admin consent, and sign in again. See Troubleshooting for other problems.
Create your app registration
Create the single-tenant Entra app registration Kairavo signs in with, add the delegated Microsoft Graph permissions and grant admin consent.
Activate your license
Activate your license key, understand what the license check sends, work offline, deactivate an installation and share the license with other admins of the tenant.