About
Methodology, sources & honest limits
What this is
M365 Profiles is an interactive decision tree that matches a Microsoft 365 identity profile
to the right license tier. It's a static Astro site — no backend, no accounts, no analytics,
no telemetry, no cookies. The full decision data lives in src/data/tree.js
and every edge is automatically verified reachable by
scripts/validate-tree.js.
What this is not
Not official Microsoft guidance. This is an independent community helper — not a Microsoft product, not endorsed by Microsoft, and not a substitute for professional licensing advice. Always verify SKUs and entitlements with your Microsoft account team or licensing partner. The Microsoft Product Terms are the source of truth.
Methodology
- Source-first. Every question, recommendation, and edge case links to a Microsoft Learn page or another primary source. If a rule isn't backed by a citation we can show you, it doesn't ship.
- Per-user vs role-gated. Most Microsoft admin portals enforce role-based access control rather than per-user license assignment. The tree distinguishes between "the admin operating the portal" (role-gated) and "the user being protected" (license-required). The few admin scenarios where the admin's own account is the licensed party — PIM, Identity Governance configurer, Remote Help helper, Teams Premium admin features, Copilot use, GSA client — are called out individually with the Microsoft Learn citation.
- Sovereign-cloud caveats. Government tenants are routed through a cloud picker (GCC, GCC High, DoD IL5, Air-Gapped IL6) and every result is tagged with the feature-parity caveat for that cloud.
- One source of truth. The decision tree is one module. The interactive assessment, the reference catalog, and the generated PDF all read from the same data — they cannot drift.
AI & build-time content
Some recommendation descriptions, examples, and plain-English explainers are authored with AI assistance and then reviewed against the cited Microsoft Learn page. AI-assisted content is treated the same as human-authored content — it ships only if it matches its citation. No runtime AI calls are made; the site is fully static and your answers never leave your browser.
Trademark & brand notice
Microsoft, Microsoft 365, Azure, Entra, Defender, Purview, Intune, Teams, Copilot, and related product names are trademarks of Microsoft Corporation. This site uses those names in their nominative descriptive sense — to identify the products being discussed. The four colored accent squares used as a favicon and navbar mark are not the Microsoft corporate logo and are presented as a decorative echo, not as a brand mark. This project is not affiliated with, sponsored by, or endorsed by Microsoft Corporation.
Security & privacy
- No backend. The site is fully static, served from GitHub Pages.
- No tracking. No analytics, no cookies, no fingerprinting, no third-party scripts at runtime.
- No accounts. Your assessment answers live in
sessionStorageon this device and are cleared on a new release or when you close the tab. - Defense-in-depth headers. CSP, Referrer-Policy, and Permissions-Policy are
set via
<meta>tags. See SECURITY.md for the vulnerability-reporting policy.
Contributing
Issues and pull requests welcome at github.com/billmcilhargey/m365-profiles. For PRs that change licensing logic, please cite the Microsoft Learn page the rule comes from so reviewers can verify it.
Acknowledgements
- UI patterns inspired by the Microsoft Zero Trust Assessment.
- License cross-references built on top of m365maps.com by Aaron Dinnage.
- Built with Astro and jsPDF.