HAWKiTECH CLOUD SECURITY OPERATIONS

Multi-Tenant Cloud Setup Wizard

Universal administrative onboarding, least-privilege consent flows, and security posture ingestion across Microsoft 365, Cloudflare Edge, and Google Workspace.

100% Fail-Closed: Zero write permissions across all providers
Ephemeral Assertions: Cryptographic client assertion auth on SC-101
Append-Only Ledger: Immutable audit logging of all posture checks

STEP 1 HAWKiTECH Home App & Certificate Registration

SC-101 Runner: 463/463 Green

Staged containerized runner (hawki-m365-runner:c4a017cc) on SC-101. Configured with 180-day RSA 3072 key/certificate for mutual token signing.

STEP 2 Generate 1-Click Client Onboarding Link

Universal Tenant Routing

Provide this deep-link to the customer Global Administrator. Microsoft prompts for consent and passes the tenant token back to HAWKiTECH without sharing administrative passwords.

https://login.microsoftonline.com/common/adminconsent?client_id=HAWKiTECH-M365-Ops&redirect_uri=https://www.hawkitech.com/m365-consent/&state=swisheria.org
Open Consent Screen →
  • 100% Read-Only Application Scopes: 9 Microsoft Graph Application permissions + 1 Exchange Online. Zero write authority.
  • Automatic Tenant Discovery: Entra ID resolves customer Tenant ID dynamically upon Global Admin login and redirects to our verified callback.
  • Isolated Cryptographic Storage: Private keys held in mode 0700 memory on SC-101. Audit evidence logged to append-only ledger.

STEP 3 Exchange Online Mail Hygiene: Global Reader Role

Mail Flow & Transport Audit

To evaluate SPF/DKIM/DMARC alignment, mail forwarding rules, and transport hygiene without mailbox write access, customer assigns the built-in Global Reader directory role to the Enterprise Application.

Open Entra Global Reader Role Blade → Direct blade deep-link for customer Global Admin

CLOUDFLARE Edge & DNS Security Posture Ingestion

Zero Trust Edge

Audit DNS hygiene, WAF rule configurations, SSL/TLS encryption tiers, and proxy states with read-only scoped credentials.

Method 1: 1-Click OAuth 2.0

Client logs into Cloudflare dashboard, selects their DNS zone, and grants HAWKiTECH read-only visibility in 1 click.

Launch Cloudflare OAuth Flow →

Method 2: Scoped Read-Only API Token

Client provisions an API token restricted specifically to their domain with Zone:Read, DNS:Read, and WAF:Read.

Open Cloudflare Token Generator →

GOOGLE Workspace Posture & Identity Audit

Google Admin SDK

Evaluate Super Admin 2-Step Verification compliance, external mailbox forwarding rules, OAuth app authorisations, and security event streams.

1-Click Super Admin Domain-Wide Consent

Authorize the HAWKiTECH Workspace Collector with read-only Directory and Reports API access without sharing passwords or credentials.

Launch Google Workspace Flow →

FLEET Managed Tenants & Telemetry Posture

All Runners Healthy

Live synchronization status across HAWKiTECH multi-tenant telemetry runners and monitoring nodes.

Tenant / Account Classification Platform Onboarding Posture Audit Runner
Corridor Technology Solutions Home Tenant Microsoft 365 Phase P1 Pilot Ready SC-101 (hawki-m365-runner)
City of Swisher Municipal Client M365 & App01 Phase P2 Candidate SC-101 / App01 (10.99.9.121)
Northtowne Brocade Core Network Infrastructure ICX 6610 (Dev 13) Active & Polling SC-01 (LibreNMS)
Liebe Transport Inc Enterprise Customer AD + DNS HA AdGuard HA Active SC-01 / Liebe (192.168.31.241)
Meade CPA Platform01 Client Cloud Core (Dev 15) Active & Monitored SC-01 (LibreNMS)
MoonBridge Core Client Cloud Core (Dev 16) Active & Monitored SC-01 (LibreNMS)
Hermes SEG Mail Gateway Dev 18 Active & Monitored SC-01 (LibreNMS)
Copied to clipboard