Skip to main content

Agentless assessment

NobleCloak Discover turns the OAuth grants already recorded in your directory into a risk report — which third-party and AI apps your users have authorized, and what those apps can see — nothing new to deploy, and nothing agent-based watching your environment. The agentless lane gets that shadow-AI and third-party-app risk report into Discover without connecting your identity provider or Google Workspace to us at all. You run a small open-source script against an admin console export you already have, review the file it produces, and upload that file yourself.

What it is​

noblecloak-tools is a pair of offline export scripts — one for Google Workspace, one for Microsoft Entra ID — that turn an OAuth-grant inventory you already have access to into a small, pseudonymized file called a Discover Export Format (DEF) file. Both scripts run entirely on your machine: neither opens a network socket in file mode, and nothing about your directory is sent anywhere until you choose to upload the resulting file.

That file — one line per (user, application) grant, identifiers replaced with pseudonyms by default — is what you hand to NobleCloak Discover. Discover reads it, and nothing else about how it was produced.

Be clear-eyed about what this gives you​

An export-based report is point-in-time, built from whatever the source export already covered:

  • It reflects the grants visible in the export the moment you ran the script, not a live view of your directory. Nothing gets more current until you export and upload again.
  • For Google Workspace specifically, the source is the OAuth Token Audit Activity log, which has a retention window (commonly around six months; see Google's data-retention documentation) — an app authorized outside that window, and never re-authorized since, will not appear. The report is derived from the events the audit log still has, not the complete authorization history of the tenant.
  • Coverage is stated honestly rather than assumed: when the script cannot determine the total number of users or the export's time window, those fields are left null in the file rather than guessed. See the export format page for exactly what that looks like.

None of this makes the report wrong — it makes it a snapshot, and it is worth choosing this lane knowing that going in.

When to connect directly instead​

The Discover app also offers a direct connection to your identity provider, set up from within the app itself (look for Connect on the empty state) rather than through a script you run yourself. Choose that path over the agentless lane when you want:

  • A live view of grants, not a snapshot from whenever you last exported.
  • Sanctioned-app signal — a direct connection can tell a company-approved integration apart from a self-granted one; an offline export cannot.
  • Continuous re-scanning without anyone re-running a script and re-uploading a file by hand.

The agentless lane exists for the opposite case: you want a report today, without connecting anything, and a point-in-time snapshot is an acceptable trade for that.

How it works, and what it costs you privacy-wise​

  1. Read the privacy statement before you run anything — it sets out field by field what leaves your machine (one pseudonymized file) and what never does (the salt, the identity mapping, raw emails).
  2. Download the script for your environment from downloads and checksums, and verify its checksum before you run it.
  3. Follow the how-to for your environment:

Reference material: