What exactly do you ask permission for?
A Lite Scan uses three delegated read permissions and works on plain Pro licences. A Full Scan adds Tenant.Read.All and, honestly, one write scope: Report.ReadWrite.All. Microsoft requires it for the read-only Get Report Definition call, which is the only reason it is there. Everscope has no code path that writes to your tenant, and you will see that scope on the consent screen rather than discovering it later.
What does a Lite Scan actually find?
Less than you would like, and the product says so on screen. Lite reaches the catalog layer only, so rules that need model structure, DAX or Power Query cannot run. On a tenant where a Full Scan returns a hundred and twenty-five findings, Lite returns a handful. That gap is the permission, not your estate, and the coverage panel names which layers were missed rather than leaving you to assume everything is fine.
Do I need Premium or an XMLA endpoint?
No. Everscope reads through the standard Power BI and Fabric REST APIs and uses no XMLA anywhere. Nothing in the product requires Premium or Fabric capacity.
Does any of my data leave the tenant?
No data values. Everscope reads and stores metadata: object names, table and column names, relationships, DAX and M expression text, usage counts and refresh timings. Expression text can contain a value if someone typed one into a measure, and it is treated as confidential accordingly. Everything is processed and stored in EU regions.
Why rules instead of AI?
Because governance findings get argued with. A deterministic rule produces the same finding on the same estate every time, states its version, and shows the metadata it evaluated. That is defensible in a change board meeting. A probabilistic answer is not, however good it sounds. There is no model anywhere in the analysis path.
How is this different from the Power BI admin portal?
The admin portal tells you what exists right now. It does not tell you what changed since last week, it does not group problems into rules with evidence, and it has no concept of an owner, a decision or a deadline. Everscope keeps every scan, diffs them, and turns a finding into something with a name on it and a date next to it.
What happens if I cancel?
Scanning stops at the end of the paid period. You can export the full evidence trail before or after that, and the stored metadata is deleted within thirty days. No exit interview.