🛡️ Security & Compliance
Technical and compliance background for security teams, IT administrators, and compliance officers evaluating GetCurrent.
Enterprise-grade security by design
GetCurrent is built on Microsoft's Zero Trust and Least Privilege principles. The platform is read-oriented, tenant-scoped, and designed to minimise both stored data and operational secrets.
Zero Trust
Tenant-scoped and administrative API calls are authenticated via Microsoft Entra ID. Public feed endpoints remain read-only, and no hardcoded secrets are used.
Least Privilege
Only the minimum Microsoft Graph permission required for tenant Message Center access is requested, and MCP tools expose read-only operations only.
Minimal Storage
GetCurrent stores core account, tenant, lifecycle, token, audit, and cached-content records needed to operate the service, without storing unnecessary Microsoft 365 configuration data.
Controlled Lifecycle
Tenant onboarding, disable/enable, offboarding, deletion, and MCP token revocation are explicit actions with auditability and operational signalling.
Summary
- Authentication exclusively via Microsoft Entra ID — no local passwords stored in GetCurrent
- No application-only Microsoft Graph permissions for customer-tenant Message Center access
- Secrets managed through Azure configuration and managed identity patterns — never hardcoded in the app
- All Azure resources and persisted data run in West Europe (EU-hosted)
- CSRF validation, JSON Content-Type validation, and response security headers protect mutating APIs
- Rate limiting is applied to public, sensitive, and MCP routes
- Operational events and sensitive write actions are audit logged
- Application and security logs redact PII and sensitive values before emission
- MCP API is authentication-required by default; bearer tokens are hashed at rest, revocable, and time-limited
- MCP tools are strictly read-only — no write or tenant-configuration operations are exposed
Reference Architecture
GetCurrent runs entirely on Microsoft Azure in the West Europe region. All core components are fully managed cloud services — no on-premises infrastructure required.
Authentication layer
EU-hosted
Delegated access
Serverless
Tenant-scoped auth
Security controls
- TLS 1.2+ required on all endpoints
- HTTPS-only — HTTP traffic is automatically redirected
- CORS restricted to the application's own domains
- Secrets stored in managed Azure configuration and Key Vault references
- Database access via Managed Identity where available
- Operational monitoring, audit logging, and notification-based alerting are enabled
Authentication & Authorisation
GetCurrent uses Microsoft Entra ID for interactive authentication. There are no local passwords, no local identity store, and no customer-tenant service accounts.
Sign-in flow
- User clicks Sign In and is redirected to Microsoft Entra ID
- Microsoft handles authentication; Azure Easy Auth validates the resulting session on each request
- GetCurrent reads the trusted client-principal header injected by the platform — never the raw browser token
- User identity is resolved from claims such as email, object ID, and tenant ID
- Session lifecycle and MFA enforcement remain under Microsoft Entra ID and tenant policy control
Tenant onboarding
- A Global Administrator or Privileged Role Administrator grants admin consent for the GetCurrent app registration
- After consent, Message Center messages for that tenant can be fetched via Microsoft Graph delegated access
- Tenant lifecycle status controls whether sync and tenant-scoped access remain active
- Consent can be revoked at any time in Entra ID → Enterprise Applications
No customer-tenant service accounts
- No application-only (app-role) Microsoft Graph permissions are used for customer Message Center access
- No shared service accounts are required in the customer tenant
- No refresh tokens are stored outside the Microsoft Entra / Azure session model
- Background processing uses GetCurrent-managed infrastructure rather than customer credentials
Multi-Factor Authentication
- MFA is enforced by the customer tenant via their own Conditional Access policies
- GetCurrent honours the authenticated Microsoft Entra session and claim set
- The app relies on Microsoft Entra for primary authentication assurance rather than implementing a separate MFA layer
Microsoft Graph API Permissions
GetCurrent requests minimal, delegated permissions only. No write permissions, no mailbox access, and no directory-management scopes are used.
| Permission | Type | Purpose | Admin consent |
|---|---|---|---|
ServiceMessage.Read.All | Delegated | Read Message Center posts for the tenant | ✅ Required |
openid | Delegated | Basic sign-in (OpenID Connect) | No |
profile | Delegated | Display name and basic session identity | No |
email | Delegated | Email address for account identification | No |
offline_access | Delegated | OAuth refresh support where applicable | No |
ServiceMessage.Read.All requires admin consent. All other permissions are standard OIDC scopes. No write permissions are requested.What GetCurrent cannot do
- Read or send email on behalf of users
- Access SharePoint, Teams, or OneDrive content through Microsoft Graph delegated tenant consent
- Read or modify directory objects, groups, or tenant configuration
- Create or modify Microsoft 365 settings in the customer tenant
- Use background app-only Graph access against customer data without a signed-in tenant relationship
Data & Privacy
GetCurrent stores the minimum operational data required to deliver the service, provide tenant features, enforce security controls, and support auditability.
| Data | Stored? | Purpose | Retention |
|---|---|---|---|
| Tenant ID & domain | ✅ Yes | Tenant association, lifecycle management, scoped access | Until deletion / lifecycle removal |
| Email address & user ID | ✅ Yes | Account identification, ownership, auditability, notifications | Until account deletion or administrative cleanup |
| Tenant owner / role records | ✅ Yes | Authorisation for tenant administration | Until removed or tenant deletion |
| Bookmarks & saved items | ✅ Yes | Personalisation feature | Until deleted by user |
| Message Center content | ✅ Yes (cached) | Powers tenant and reference Message Center views | Refreshed on sync; tenant links removed on offboarding |
| Audit logs & operational history | ✅ Yes | Compliance, troubleshooting, security review | Retained for operational and audit purposes |
| MCP access tokens | ✅ Yes (hashed only) | Bearer-token access for MCP and related API use cases | Until expiry, revocation, or deletion |
| User profile photo | ❌ No | — | — |
| Raw passwords | ❌ No | — | — |
| Customer tenant M365 configuration | ❌ No | — | — |
Privacy, logging, and monitoring
- Logs redact PII and sensitive values such as email addresses, tokens, secrets, and connection strings before emission
- Free-text MCP search parameters are redacted before being written to telemetry or audit records
- Operational notifications can be generated for onboarding, offboarding, lifecycle changes, auth issues, and other admin-relevant events
- Analytics is only enabled in production after explicit cookie consent
GDPR / AVG
- All persisted application data is stored in Azure West Europe — no routine data storage outside the EU
- SecMinds acts as data processor; your organisation remains data controller for its tenant data
- Data subject requests (access, deletion) can be submitted via our contact page
- Tenant offboarding disables tenant linkage and removes tenant Message Center associations; broader retention and deletion follow administrative lifecycle handling
Sub-processors
- Microsoft Azure (West Europe) — hosting, database, functions, managed identity, Key Vault references
- Microsoft Graph API — source of tenant Message Center data
- Microsoft Entra ID — identity provider and authentication platform
- Google Analytics (GA4) — consent-gated usage analytics with IP anonymisation enabled
- Microsoft Clarity — consent-gated session replay and heatmaps for UX improvement
Analytics & Cookies
- Google Analytics collects page-view and navigation telemetry with IP anonymisation enabled
- Microsoft Clarity records anonymised behavioural session data to improve user experience
- Both services are enabled only on the production hostname
updates.getcurrent.cloud - Analytics cookies are only loaded after explicit consent via the cookie banner
- You can change your cookie preferences at any time via the Cookie Settings link in the footer
MCP API — Security Model
GetCurrent exposes a Model Context Protocol (MCP) server at /api/mcp. AI assistants such as GitHub Copilot and Claude can query Message Center, M365 Roadmap, and What's New data through this endpoint. The MCP layer follows the same tenant isolation and security controls as the broader application.
Authentication required by default
The MCP endpoint requires authentication by default (MCP_REQUIRE_AUTH=true). Unauthenticated callers receive a 401 plus OAuth discovery metadata.
Tenant isolation
Authenticated callers only receive data from their own onboarded tenant where tenant-scoped data is involved. Unauthenticated access, if explicitly enabled, is limited to reference data.
Bearer token lifecycle
Personal MCP tokens are generated in Settings → Tenant, stored hashed at rest, shown once at creation, and can be revoked or deleted individually.
Read-only tools
MCP tools do not expose write, delete, onboarding, tenant-administration, or configuration operations. The interface is limited to read and diagnostic capabilities.
Authentication methods
| Method | How it works | Tenant context |
|---|---|---|
Bearer token (gct_…) | Generated in Settings → Tenant → MCP access tokens; sent in the Authorization header | Own onboarded tenant |
| Azure Easy Auth session | Browser session from the GetCurrent web app, validated through platform-authenticated headers | Own onboarded tenant |
| Unauthenticated (opt-in) | Only when MCP_REQUIRE_AUTH=false; intended for anonymous reference-data access | Reference tenant only |
Token security
- Tokens are generated with cryptographic randomness
- Only a SHA-256 hash is stored in the database; the raw value is never stored or returned after creation
- Tokens use a
gct_prefix for recognition and handling - Token expiry is enforced on each request; the default lifetime is 90 days, configurable up to 365 days
- Token creation, revocation, deletion, and MCP tool use are audit logged
- Revoked or expired tokens are rejected immediately
OAuth discovery & interoperability
- OAuth protected-resource metadata is exposed at
/.well-known/oauth-protected-resource - Authorization-server metadata is exposed at
/.well-known/oauth-authorization-server - MCP clients that support OAuth discovery (for example
mcp-remote) can automatically initiate Microsoft Entra sign-in - GetCurrent relies on Microsoft Entra ID as the authorization server; it does not implement a custom OAuth server
Rate limiting, logging, and alerting
- The
/api/mcpendpoint is rate-limited like other public data routes - Every MCP tool invocation records tool name, tenant context, user context, duration, and error state
- User-provided free-text search parameters are redacted before being written to logs
- Repeated auth-context problems can trigger operational notifications to SecMinds administrators
- Current rate limiting is implemented in-process; limits are effective per running app instance
Exposed MCP tools
| Tool | Data source | Write access | Requires auth |
|---|---|---|---|
get_message_center | Tenant Message Center or reference tenant | ❌ No | ✅ Yes (default) |
get_roadmap | Public Microsoft 365 Roadmap | ❌ No | ✅ Yes (default) |
search_whats_new | Public Microsoft 365 What's New feeds | ❌ No | ✅ Yes (default) |
get_connection_status | Authentication state and tenant context diagnostics | ❌ No | ✅ Yes (default) |