Cached truth vs. live truth in a Microsoft 365 security platform

While building a Microsoft 365 security platform, I encountered a simple but important design question:

Should the dashboard rely on its database, or should it query the Microsoft Graph API every time?

The database is fast. Microsoft Graph provides the most current information. On their own, neither provides the complete picture. Building an effective Microsoft 365 security dashboard requires balancing performance with real-time accuracy.

Cached Truth: Fast, but Potentially Outdated

A background worker can collect users, SharePoint sites, files, Microsoft Graph permissions, sharing links, sign-in activity, and other security data through the Microsoft Graph API, then store that information in PostgreSQL.

This cached model makes it easy to answer broad security questions quickly, such as:

• Which SharePoint sites have the most external sharing?
• How many anonymous sharing links exist across the tenant?
• What Microsoft 365 security trends are emerging over time?
• Which users or applications generate the most activity?
• Which resources require closer security monitoring?

The limitation is that cached data reflects the tenant at a specific point in time. A permission discovered 30 minutes ago may already have been removed, making it unsuitable for decisions that require real-time validation.

Live Truth: Current, but Expensive

Querying the Microsoft Graph API provides the latest view of your Microsoft 365 environment, but calling it for every dashboard row creates several challenges:

• Slow page loads
• Microsoft Graph API throttling
• Temporary API failures
• Permission errors
• Inconsistent results during large-scale queries

Because of these limitations, live data is most valuable when the decision has real security consequences, such as reviewing a sensitive SharePoint file, validating Microsoft Graph file permissions, or revoking external access.

The Hybrid Approach

The most effective Microsoft 365 security platform combines cached data with live Microsoft Graph API calls, using each where it delivers the greatest value.

• Load dashboards, reports, and search results from the cache.
• Display when the data was last synchronized.
• Query the Microsoft Graph API when a user opens a sensitive item.
• Verify the current state before taking action.
• Confirm the result afterward and record it in the Microsoft 365 audit logs.

For example, the cache might report an anonymous sharing link. Before removing it, the platform performs a live Microsoft Graph API check to confirm the link still exists. After removal, it queries Microsoft Graph again to verify the action succeeded before updating the audit log and cache.

This hybrid architecture delivers fast dashboards while maintaining the accuracy required for enterprise Microsoft 365 security monitoring.

The Real Lesson

In a security platform, truth is not just a value. It also needs context: when it was captured and where it came from.

Cached data says, “This was true when we last checked.”

Live data says, “This is what the Microsoft Graph API reports right now.”

A trustworthy Microsoft 365 security platform makes that distinction visible. It uses cached truth for speed, scalability, and reporting, while relying on live Microsoft Graph API data when security decisions require the most current information. By combining both approaches, organizations can improve performance, reduce unnecessary API calls, minimize throttling, and maintain accurate security insights across their Microsoft 365 environment.