Some entries may be missing, especially posts shown only to EDU, government, or tenants with additional products and licenses. If you manage a tenant (a dev or test tenant is ideal), you can let the archive read its Message Center. It takes about five minutes and there is no password, secret, or certificate to create or share.
The access is deliberately narrow:
- The only permission is the Microsoft Graph application permission
ServiceMessage.Read.All (Read service messages). It cannot read users, groups, mail, files, sign-ins, or any other data, and it cannot change anything in your tenant. - The app signs in with workload identity federation: Microsoft Entra only issues a token to the scheduled GitHub Actions workflow on the
main branch of merill/mc. No credential exists that could leak. - You can remove access at any time by deleting the enterprise application in your tenant.
Thank you, contributors
Thanks to Andrés Gorzelany (snoopcore.com), and 3 people who prefer to stay anonymous, for sharing their tenant's Message Center with the archive.
Option 1: one-click admin consent (recommended)
You need a Global Administrator or Privileged Role Administrator account, because only those roles can consent to a Microsoft Graph application permission. This works for tenants in the commercial cloud, including GCC; GCC High, DoD, and other sovereign clouds are not supported.
- Select Grant read-only access below and sign in with your admin account.Grant read-only access
- Check that the prompt names the Message Center Archive - Reader app and lists only Read service messages as the permission it requests, then select Accept. This adds a Message Center Archive - Reader enterprise application to your tenant.
- Microsoft returns you to this site, which shows your tenant ID. Add any optional details (tenant type, notable licenses, and whether you would like to be credited), check the email it prepares, and select Send the email or copy it and email it to me.
- I confirm the app can read your Message Center, add your tenant to the private list, and reply when it is live. New posts show up within a few hours of the next refresh.
Option 2: use your own app registration
Use this if your organization does not allow apps registered in other tenants. You own the app and its federated credential, and can remove either at any time. You need an Application Administrator to create the app, and a Global Administrator or Privileged Role Administrator to grant consent.
- In the Microsoft Entra admin center, go to Entra ID > App registrations > New registration. Enter the name
Message Center Archive - Reader, choose Accounts in this organizational directory only, leave the redirect URI empty, and select Register. - Open API permissions. Remove the default
User.Read permission, then select Add a permission > Microsoft Graph > Application permissions, tick ServiceMessage.Read.All, and select Add permissions. Select Grant admin consent and confirm. - Open Certificates & secrets > Federated credentials > Add credential and enter:
- Federated credential scenario: GitHub Actions deploying Azure resources
- Organization:
merill - Repository:
mc - Entity type: Branch, GitHub branch name:
main - Name:
mc-archive, and leave the audience as api://AzureADTokenExchange - Next to Subject identifier, select Edit (optional) and replace it with
repo:merill@1288081/mc@761074595:ref:refs/heads/main
The repository uses GitHub's immutable subject format, so the default repo:merill/mc subject will not match. Do not create a client secret or certificate. - From the app's Overview, copy the Directory (tenant) ID and Application (client) ID into this pre-filled email and send it. I verify the connection and reply when it is live.
Your privacy
- Your email address and tenant ID are kept in a private repository that only I can read, and are never published.
- The public workflow receives tenant IDs from an encrypted GitHub Actions secret, masks them in its logs, and reduces sign-in errors to error codes so logs never reveal which organizations contribute.
- The archive does not record which tenant a post came from. If you tell me your tenant is an education tenant, posts that only education tenants received are labelled "Seen in EDU tenants", which never names or identifies a tenant. You are only credited if you ask to be. Otherwise your tenant is only counted.
- I will never ask you for a password, client secret, or certificate. If anyone does in the archive's name, it is not me.
Removing access
In the Microsoft Entra admin center, go to Entra ID > Enterprise applications, open Message Center Archive - Reader, and select Properties > Delete (for option 2, delete the app registration). Access stops as soon as the existing token expires, within an hour. Email [email protected] if you would also like your details removed from my list.
Questions first? Reach out through LinkedIn, X, or Bluesky.