Private deployment

Your permissions. Your infrastructure. Your data.

Deploy Access Witness inside your own Azure subscription, on-premises virtual machines or private cloud. Your SharePoint permission history is recorded into a database you own and never sent to a third-party SaaS database.
Inbound access
None required
Nothing on the internet needs to reach your servers
Permission data
Stays with you
Only the license and update checks reach us; see the list below
Microsoft 365 access
Used only to read
Full control, because SharePoint requires it to show permissions; never changes permissions, sharing or content
Network
Outbound only
To Microsoft 365, and to our licensing service

Where it runs

Everything that holds your history stays inside your network

It connects out in two directions only: to Microsoft 365, to read, and to our licensing service, to check the license and offer updates.

Customer Microsoft 365 tenant

SharePoint Online, Entra ID

Microsoft
Sites and permissionsRead
Groups and membershipsRead
Audit logRead

Your network

Permission data stays here

Your Windows Server

On-premises or in your Azure subscription

DashboardYour team's view, in the browser
Recording serviceKeeps the history up to date
Sign-inYour Microsoft Entra ID

Your SQL database

SQL Server 2019 or later

Permission historyYours
Every recorded changeYours

No inbound connections

Nothing on the internet reaches in

Public endpointNone required
Dashboard accessYour network or VPN

Access Witness licensing

License and update checks

Vendor
License key, installation, tenant IDSent
Product version, licensed-user countSent
Permissions, names, filesNever
Audit recordsNever
Nothing on the internet needs to reach your servers. They connect out to Microsoft 365, to read, and to our licensing service, to check the license once a day and offer updates. There is no offline mode.
Access Witness reads SharePoint Online, so it needs a connection to Microsoft 365. The license is also checked online once a day. There is no offline mode, and we don’t pretend otherwise.

Data boundaries

What stays, and exactly what leaves

Nothing about your permissions leaves. To check the license and offer updates, a few facts about the installation do. Here is the whole list.

Stays in your infrastructure

Never sent to us

  • Who can reach every site, library, folder and file, and where each permission is set
  • SharePoint group, Microsoft Entra ID and Microsoft 365 group memberships, including groups inside groups, over time
  • Site addresses, the library and folder structure, and file names
  • Every recorded change: permissions, sharing links, guest invitations and memberships, and who made them
  • The credentials it reads Microsoft 365 with: created on your server, never sent to us

Sent to our licensing service

To check the license once a day, and for updates

WhatWhy
Your license keyTo confirm the license is valid
Which installation this isOne license, one deployment
Your Microsoft 365 tenant IDAn identifier, not a name: the license covers one tenant
The product versionTo offer the right updates
How many licensed users you haveOne number, never a list of people

Our licensing service never receives permissions, names or lists of people, group memberships, site addresses, file details or audit records.

Deployment options

Private Edition today

Private Edition is the product today: it runs on your servers, with your database.

A hosted edition is on the roadmap Roadmap and does not exist yet. We don’t claim certifications we don’t hold; the security page says what we do claim.

Private deployment

Walk through it with your infrastructure team.

Bring your server, database and network questions. We will map it to your environment.

Private deployment. Customer-controlled SQL database. Outbound-only connectivity.