Skip to main content

CET2 — Clefsoft Endpoint Toolkit 2

CET2 is a Graph-First, multi-tenant endpoint-management portal for MSPs and IT teams. It shows live Microsoft Intune and Entra ID data — devices, users, apps, compliance, Autopilot, configuration profiles, Windows Update, and certificate/token expiries — and performs governed write actions (device sync, retire, wipe; user disable/enable, revoke sessions, temporary access pass), all read live from Microsoft Graph.

CET2 stores no customer device or user inventory. There is nothing to sync, nothing to go stale, and nothing to leak beyond a small metadata store (RBAC assignments, the tenant registry, and audit logs).

What makes CET2 different​

  • Graph-First — every page is a live Graph query with an explicit $select. What you see is what Intune/Entra actually has right now.
  • Multi-tenant by design — one portal instance can serve any number of customer tenants. Customer admins sign in with their own Entra accounts and see only their own tenant.
  • Deny-by-default RBAC — every API call is authorised against the caller's tenant-scoped role assignment. A signed-in user with no assignment sees nothing, not an error.
  • Governed write actions — the Action Broker enforces reason capture, confirmation (type-to-confirm for destructive actions), step-up re-authentication, rate limiting, and a durable audit trail on every write, before it ever reaches Microsoft Graph.

Where to start​

Live instance​

The ClefSoft-hosted instance of CET2 is live at portal.clefsoft.co.uk.