From on-premises to the cloud, without losing the thread.

Active Directory

Computer objects as the directory itself holds them — which is not the same list as MECM discovery, filtered by its own scopes. And the group policies, with what LDAP knows about them: where they are linked, whether each link is enabled or enforced, and whether either half is switched off.

• computer objects, replicated last logon
• group policy objects and their links
• GPO settings, read from SYSVOL

MECM / SCCM

Read through the AdminService or, on a domain-joined host, straight through WMI. Applications and deployment types, packages, collections, discovered devices — and the delegation, meaning who can change what on which machines.

• applications, deployment types, packages
• collections and discovered devices
• site health check
• delegation: security scopes and collections

Entra ID

The cloud directory, read in its own right: the devices it holds, the groups that act as assignment targets, and each machine's join — hybrid or native. It is also what authenticates the people who open Meti.

• devices and join type
• groups, the targets of assignments
• accounts, and Meti's own sign-in

Microsoft Intune

Read and write through Microsoft Graph. This is the only side Meti writes to — and it writes as you, bounded by your own roles.

• applications and assignments
• configuration policies and their settings
• compliance policies, managed devices
• tenant health check
• delegation: scope tags and scope groups

Your CMDB

Imported from a CSV export — a file handed over by the asset manager needs no service account, no API key and no firewall rule — or read through its API. Twelve products are recognised out of the box, from ServiceNow to GLPI, each with its own status words.

• columns guessed, in French as in English
• every distinct status shown and mapped
• the serial number, the join the directory never offers

MECM health check

The state of the site and a security audit in one page: roles and servers, disk space tightest first, client health, deployments by failure rate, collection evaluation past the guidance ceiling, automatic deployment rules failing silently. Server hardening is collected by a read-only script that prints facts only, never verdicts — the grading stays in Meti, in one tested rule set. A fourth status sits beside pass, warn and fail: nobody could take this reading, which never rounds down to « fine ».

Intune health check

The same reading on the cloud side, run with every collection that reads Intune: what is in place, what is not, and what is in place without serving anyone. It opens on its last analysis rather than querying the tenant again on every display.

Intune CSP analyzer

Whether two policies fight over the same setting, whether one applies to nobody, and whether an exclusion has quietly cancelled an include. Settings and assignments read together: a policy is not a thing, it is a claim about a population. One setting per row and across every policy, so that « who sets this, and to what » becomes a filter rather than a tour of every policy.

RBAC Analyzer

Who can change what, over which machines, in both consoles. Two answers, because there are two mechanics: Intune bounds with scope tags and scope groups, MECM with security scopes and collections — and the two fail differently, Intune by omission, MECM by leaving a default in place that looks like a boundary and is not. Every finding is written out in words: a role held by a named individual rather than a group, a custom role nobody holds, a scope nothing references.

Intune rings

How far a change has reached from one ring to the next — the sentence Intune has never been able to say, listing policies and listing assignments without ever stating that production is two changes behind the pilot. Settings are grouped by the pattern of their disagreement, meaning which rings hold which value, rather than blended into one diff that would mix every change in flight.

Source of authority

A compliance report at 75% whose missing quarter is half machines that no longer exist teaches nothing: they are still in the directory, so still in the denominator. Name the list you trust — Active Directory, Entra ID, Intune, MECM or the CMDB — and the estate is read against it, in four standings: held, retired, unknown, out of scope. The raw rate stays printed beside the adjusted one, without which an authority would just be a filter that improves everything.

Migration progress

How much of the on-premises estate has moved to Intune, measured from what was collected, and how that figure has changed since the first measurement. Every migrated object counts towards it — an application created but never deployed cannot pass for finished work. Beside it, tiles of your own: counts, charts and tables built on any collected property, with conditional formatting and value mapping.

Reports & logs

A catalogue of about three documents per page, and one engine that renders them in three formats, chosen at the moment of export: a self-contained HTML that opens on a double-click on a machine with no network, a PDF, and a PowerPoint with native charts — so a client can restyle it and read its data. Plus CSV for a spreadsheet. The logs keep every collection and every synchronisation: a read that failed is a fact about Meti, not about the estate, and belongs there rather than as a banner across the page that happened to notice it.