Requirements
What do you need to run Access Witness?
Everything your IT team will check before you buy: the servers, the database, the network, and the approval in Microsoft 365. Setup checks the server and the database again before it changes anything, and says what to fix.
- Servers
- Windows Server 2019 or later
- One server, or two if you want the Dashboard and the recording service apart
- Database
- SQL Server 2019 or later
- On your own server or virtual machine
- Microsoft 365
- Administrator approval
- A Global Administrator signs in during setup
- Network
- Outbound HTTPS only
- Nothing on the internet needs to reach your servers
Minimum and recommended
For one server running everything, up to 5,000 licensed users. Above that, or for large tenants, run the Dashboard and the recording service on two servers with SQL Server on its own; we size it with you during the evaluation.
| Minimum | Recommended | |
|---|---|---|
| Operating system | Windows Server 2019 (64-bit) | Windows Server 2022 or 2025 (64-bit) |
| Processor | 2 cores | 4 cores |
| Memory | 8 GB | 16 GB, or 32 GB with SQL Server on the same server |
| Program drive | 5 GB free | SSD with 20 GB free |
| Database | SQL Server 2019 Express, for an evaluation (10 GB database limit) | SQL Server 2019 or later, Standard or Enterprise, on SSD storage |
| Browser for the Dashboard | A current version of Microsoft Edge or Google Chrome | A current version of Microsoft Edge or Google Chrome |
Which servers do I need?
- Windows Server 2019 or later: on-premises, on Hyper-V or VMware, or an Azure virtual machine.
- One server runs everything. If you prefer, split it across two: one for the Dashboard your team opens in a browser, one for the service that records.
- The Dashboard runs on IIS with .NET 10. The setup wizard installs them if they are missing.
- At least 5 GB free on the program drive, for the program, its logs and updates. The recorded history lives in your database, not on this disk.
- An HTTPS certificate for the Dashboard's address, from your own certificate authority. For a pilot, setup can create a test certificate.
- Administrator rights on the server for the person installing.
Which database?
- SQL Server 2019 or later, on your own server or virtual machine.
- The person installing needs permission to create a database. Alternatively, create an empty one and make them its owner.
- The product's own accounts get only the rights they need.
What network access does it need?
- Outbound HTTPS (port 443) to Microsoft 365, to read SharePoint, groups and the audit log.
- Outbound HTTPS to the Access Witness licensing service: to activate the license during setup, then for the daily license check and updates.
- No inbound connections from the internet. Your team opens the Dashboard on your own network, or over your VPN.
- If you use two servers, both need to reach your SQL Server.
- There is no offline mode: the license is checked online once a day.
What do we approve in Microsoft 365?
- A Global Administrator signs in during setup to approve access; with two servers, in the setup on each. If the person installing isn't one, they can leave that step for someone who is.
- Setup registers Access Witness's applications in your Microsoft Entra ID, so while that administrator is signed in it needs the right to register applications. It lists the permissions the scanning application gets before granting them, and when it is done, even if it stopped part-way, it removes its own access.
- The scanning application reads sites, users, groups, the apps that have access to SharePoint, and the audit log.
- Microsoft 365 audit logging must be turned on. It is on by default for most tenants.
- Why full control? SharePoint shows who has access only to an app that holds full-control permission. Access Witness uses it only to read; it never changes permissions, sharing or content.
- Your team signs in with their own Microsoft 365 accounts, with four roles from product administrator to read-only. Signing in lets the Dashboard read who you are, nothing more: it cannot change anything in Microsoft 365.
How is it licensed?
- One license covers one deployment for one Microsoft 365 tenant.
- It is priced by licensed users: people in your tenant with at least one Microsoft 365 license assigned. Unlicensed guests don't count. The tiers are up to 1,000, up to 5,000 and more than 5,000 licensed users, from CA$12,000 for one year.
- The license is confirmed online once a day. The only thing it reports about your users is one number.
- A 60-day evaluation runs on your own servers, against your own tenant.
Prices and terms are on the pricing page.
How long does the first scan take?
The first full scan of a very large tenant can take days rather than hours. After that, the record keeps up as Microsoft 365 reports changes. We estimate the timing from your own tenant during the evaluation, not from a published number.
Requirements
Check it with your IT team, then see it work.
Setup checks the server and the database before it changes anything.
Private deployment. Customer-controlled SQL database. Outbound-only connectivity.