Every tenant produces a security event log nobody reads. It's enormous, it's mostly noise, and the interesting parts look exactly like the boring parts until someone sits down and works through them.

Daylight does that work every month.

How the audit works

Pull — the month's security event log is collected from your tenant
Triage — heuristics flag the failure modes that actually matter, and the noise stays in the log
Examine — each flagged case goes to an LLM with its surrounding context, not as a lone log line
Report — findings are written up in plain language and assembled into a single document

What gets checked

The heuristics target the events that precede real incidents — the quiet administrative changes rather than the loud ones:

Consent to applications and delegated permission grants
App role assignments handed to users
Privileged role assignment and additions to role membership
Service principal credentials being added
Strong authentication disabled on an account
Mailbox forwarding quietly configured
Outliers versus peers — accounts behaving unlike others in the same role

What a finding actually says

This is the part that matters, and it's what separates a report from an alert queue. Every finding covers three things:

The potential harm — what an attacker could do with this, concretely
Why it might be fine — the legitimate explanation, if there is one, so you aren't chasing your own IT department's normal Tuesday
What to do next — the actual next step, not "review this event"

Anything can raise an alert. The work is deciding which alerts are real and saying so in language a director can act on.

Integrations

Available now: Microsoft 365 / Entra ID
Next: Google Cloud
Cadence: Monthly audit cycle
Deployment: Hosted or on-premises

It also indexes your documents

Daylight carries a full document intelligence layer: OCR across scanned files and images, keyword and semantic search, and cited answers to plain-language questions across everything it has ingested.

It's genuinely useful, and it is not the reason to buy this. The audit is.

hello@rabbitholesolutions.ca