01
Reduce operational risk
Find exposed identities, weak authentication, public sharing, risky OAuth access and missing email controls.
Evidence and affected objects sit next to every finding.
Google Workspace · LiveCore OAuth verification complete
See the risk.
Find the savings.
Build the case.
TenantOne turns Google Workspace configuration data into a prioritized view of security, governance, AI readiness and cost—then packages the evidence for the people who decide what happens next.
79
automated checks
Live product registry
13
coverage categories
Core + optional sources
4
decision areas
One comparable scorecard
Read-only
connection model
No configuration changes
Assessment overview
One assessment, three outcomes
Make the technical estate legible to the business.
Security teams get evidence. Finance gets a savings signal. Leadership gets one report that makes the next decision easier.
02
Recover avoidable spend
Surface reclaimable seats, storage pressure, stale large files and the users consuming the most capacity.
Turn observed waste into an annual planning estimate.
03
Prepare for Gemini
Measure the access and sharing model that Gemini will inherit before AI makes existing exposure easier to reach.
Five readiness pillars connect the score to concrete actions.
From score to cause
Know where risk lives—not just that it exists.
A single tenant score opens into four operating views, severity-ranked findings and the affected users, groups, applications or resources behind them.
01
Identity
02
Security
03
Collaboration
04
Storage & Licenses
Executive report
AI & browser readiness
Readiness before rollout
AI inherits every access decision you already made.
TenantOne packages existing Google Workspace governance signals into a five-pillar Gemini readiness view—without inspecting prompts or model output.
Data exposure
Public and link-wide file exposure where metadata coverage is enabled.
Access control
2-Step Verification and administrator posture.
Sharing governance
Groups, external membership and Shared Drive ownership.
Third-party access
OAuth application sprawl and broad data scopes.
Content hygiene
Inactive accounts and stale content signals.
Evidence for the budget conversation
Put a number next to operational waste.
The assessment connects unused seats and archivable storage to administrator-entered prices. The result is a transparent planning estimate—not a promised saving.
Seat × price × 12
Annual license estimate
Age × size
Storage opportunity
SKU-level downgrade recommendations are part of the next scope phase. Current estimates stay explicit about entered prices and available metadata.
Storage & licenses
What the assessment measures
79 checks. 13 categories. Visible coverage.
Optional-source checks are skipped when their evidence is unavailable. Missing coverage is never converted into a false pass.
Identity
Inactive accounts, administrators, recovery posture and 2-Step Verification.
Access
Third-party OAuth grants, broad scopes and recent authentication events.
Security
SPF, DKIM, DMARC, MTA-STS, suspicious activity and policy signals.
Collaboration
Google Groups, public links, external members and Shared Drive ownership.
Storage & licenses
Seat utilization, top consumers, mailbox size and archival opportunities.
Browser posture
Chrome extensions, risky permissions, sideloading and visibility gaps.
014 checks
Authentication
Included in the core read-only assessment.
025 checks
Admin Accounts
Included in the core read-only assessment.
035 checks
Account Hygiene
Included in the core read-only assessment.
046 checks
Groups & Sharing
Included in the core read-only assessment.
052 checks
Third-party Access
Included in the core read-only assessment.
061 check
Domains
Included in the core read-only assessment.
0714 checks
Email Security
Included in the core read-only assessment.
088 checks
Monitoring
Included in the core read-only assessment.
0910 checks
Licensing & Storage
9 checks use an additional data source.
105 checks
Drive & Files
5 checks use an additional data source.
114 checks
Shared Drives
4 checks use an additional data source.
125 checks
Browser Extensions
5 checks use an additional data source.
1310 checks
Devices
10 checks use an additional data source.
A report people can use
From administrator detail to the money slide.
The same evidence is shaped for remediation, executive review and partner-led customer conversations.
A single 0–100 tenant risk score
Scores for identity, security, collaboration and storage
Critical and high findings prioritized first
Gemini readiness with five evidence-backed pillars
Key metrics and annual savings estimates
Recommended actions for owners and partners
Roadmap
More depth, without hiding the access trade-offs.
Every phase is separated by the authorization and assurance it requires. That keeps current coverage clear and future expansion deliberate.
Available now01
Verified core assessment
Read-only Google OAuth, automated checks, area scores, findings, scan history, CSV export and the executive report.
- Core OAuth verification complete
- No write-back to Google Workspace
Additional setup02
Deep metadata coverage
Drive metadata, Shared Drives and managed Chrome reporting through separately authorized domain-wide delegation.
- File contents are not read
- Unavailable sources are shown as missing coverage
Next scope review03
Richer admin context
SKU-level license analytics, endpoints, delegated-role detail, policy posture and selected alert sources.
- Batched into the next Google review
- Released only after approval and validation
Customer-led04
Restricted-scope depth
Gmail settings, labels, DLP and retention evidence where demand justifies the additional assurance process.
- Separate security assessment
- No speculative access collection
Roadmap items describe product direction, not committed release dates. Availability depends on Google approval, customer edition and source-system configuration.
Trust by design
Read what is needed. Show what is known.
TenantOne is designed as an assessment layer—not another administrator making silent changes in your environment.
Google-native authorization
Administrators connect through Google OAuth. Passwords never pass through TenantOne.
Read-only behavior
The assessment observes configuration and metadata; it does not remediate or change settings.
No file-content inspection
Drive coverage uses metadata for sharing, ownership, age and size—not document contents.
Transparent limitations
Edition requirements, unavailable APIs and skipped checks remain visible in the result.
Start with evidence
See your Google Workspace through one decision-ready view.
Explore the synthetic demo first. Review the checks, evidence, scores and executive report before connecting a tenant.