Azure Helper read-only
./how-it-works ./pricing ./architecture Launch app →
PS architect@web:~/AzureHelper>Get-Architecture -Explain
how it's wired

Read-only by design.
Safe to put next to production.

Azure Helper is a hosted web app that reads your real tenant to teach. It also ships as a browser extension that opens the same app in a side panel and adds a DevTools capture workbench for Microsoft admin portal calls. Either way, tenant execution stays read-only: the app uses delegated read scopes for supported Graph reads, and captured portal calls are evidence and export material unless you run them yourself elsewhere.

data flow

Three lanes — and the write lane never includes us

1 · connect (read-only)
You (admin)
Click "Sign in" in the side panel
PKCE
Microsoft Entra
login.microsoftonline.com · public client, no secret
.Read token
Web app / Extension
Keeps the user session and tenant link; data reads stay backend-brokered and read-only
Startup delegated permissions: openid, profile, email, offline_access, User.Read, https://management.azure.com/user_impersonation. These identify the admin and support tenant/subscription discovery, with no write scope.
2 · read & teach
Web app / Extension
Hosted web app or side-panel in Chrome / Edge / Firefox
GET (.Read)
Microsoft Graph
graph.microsoft.com/v1.0 · CORS-enabled reads
your data
Your tenant
Entra ID · M365 · returns real read data
Azure Helper backend
LLM orchestration · learning content · entitlements · audit of reads. Never sees a write token because none exists.
explanation
Web app / Extension
Renders the answer + Portal / Graph / PowerShell steps
3 · change (you run it — we're not in this lane)
Web app / Extension
Shows the exact step, three ways. Copy it.
you act
You
Run it in the portal, Graph Explorer, or your own shell
write
Your tenant
The change happens under your credentials & audit log
The Helper has no write scope, so it physically cannot enter lane 3. Every change lives in your own audit trail, made by you.
capability boundary

What it can do — and what it can't

Can
Read users, groups, roles, licenses, policies & sign-in activity
Explain your real configuration in plain language
Generate the exact Portal path, Graph call & PowerShell for any task
Run read-only Graph queries in the Explorer
Capture portal network calls in DevTools and export them as REST, PowerShell, CLI, or JavaScript snippets
Cannot
Create, update or delete any object
Assign licenses, change policies, or reset passwords
Hold a client secret or app-only write role
Act outside what your own sign-in already permits
browser support

Chrome, Edge, and Firefox

The docked side panel uses each browser's native panel API. The DevTools panel uses the browser's inspected-tab Network stream to import HAR history, watch live calls, expand Graph batches, and generate snippets. Read-only tenant scope keeps store review and enterprise allow-listing straightforward.

ConcernChromium · Chrome / EdgeFirefox
Docked panelchrome.sidePanel (114+)sidebar_action (mature)
DevTools capturechrome.devtools.networkbrowser.devtools.network
Capture startupImports current HAR, then listens liveImports current HAR, then listens live
Batch handlingShows batch request plus individual Graph child callsShows batch request plus individual Graph child calls
ExportsREST, JSON, PowerShell, Azure CLI, JavaScript fetchREST, JSON, PowerShell, Azure CLI, JavaScript fetch
Side-panel handoffCaptured calls sync through extension storage into Graph ExplorerCaptured calls sync through extension storage into Graph Explorer
BackgroundMV3 service worker (ephemeral)Persistent background still allowed
Auth/statushosted app session + /api/extension/statushosted app session + /api/extension/status
Supported storesChrome Web Store / Edge Add-onsFirefox Add-ons (AMO)
Store reviewChrome Web Store / Edge Add-onsFirefox Add-ons (AMO)
capture boundary

Network evidence, not portal control

The workbench observes requests from the inspected tab. It does not click buttons, scrape DOM state, or bypass admin consent.

local handoff

Captured calls stay in extension storage

The DevTools panel writes captures to browser extension storage so the side panel can explain them. Subscription and tenant permissions still come from the hosted app.

read-only execution

Only catalog Graph GETs run in Helper

Unknown captures can be loaded, exported, or sent to Guide. The backend still enforces the approved read-only operation catalog, and you control Graph read consent in-app.

Long-running work runs in the side-panel page (alive while open), not the killable MV3 worker.
trust & security

The boring details that make IT comfortable

public client

No secret in the browser

PKCE public-client flow — there's no client secret to extract, because the extension never holds one. App-only access (Team tier) is brokered server-side.

tokens

Short-lived & scoped

The browser keeps only the app session. Tenant data reads are brokered by the backend using read-only permissions and stop when the app consent or link is removed.

LLM

Model stays server-side

Prompts, keys and orchestration live in the backend — never shipped in the extension — alongside the read-audit and entitlement checks.

enterprise

Allow-list friendly

A read-only extension with narrow host permissions is trivial for admins to approve via Chrome / Edge enterprise policy.

data

Your data stays yours

Reads are used to render your answer and aren't retained as tenant records. Only learning progress & usage are stored per account.

portal

We don't puppeteer the portal

No fragile DOM scraping or click automation. The DevTools workbench observes network calls from the inspected tab, then turns captured Graph and portal API requests into readable/exportable snippets.

Safe enough to demo on a live tenant.

Because the worst it can do is read.

Launch the app → See pricing
./marketing ./support ./privacy-policy ./terms-of-service
© 2026 Azure Helper · Not affiliated with Microsoft.