This audit is incomplete
1 of 6 checks did not run. The findings below cover only the checks that did. Treat a low count as unproven, not as clean.
- Inbox rules forwarding outside the tenant — Skipped Microsoft Graph refused access to all 296 mailbox(es) tried. With delegated permissions the module can only read mailboxes the signed-in user can already open; an administrative role does not by itself grant mailbox access. No conclusion about external forwarding can be drawn from this run.
Coverage
| Check | Category | Status | Objects | Findings | Notes |
|---|---|---|---|---|---|
| Privileged role assignments | Privileged access | Completed | 41 | 4 | |
| Users without MFA | Identity | Completed | 318 | 3 | |
| Inactive accounts | Identity | Completed | 296 | 2 | |
| Applications with high-risk permissions | Applications | Completed | 63 | 3 | |
| Inbox rules forwarding outside the tenant | Exchange Online | Skipped | 0 | 0 | Microsoft Graph refused access to all 296 mailbox(es) tried. With delegated permissions the module can only read mailboxes the signed-in user can already open; an administrative role does not by itself grant mailbox access. No conclusion about external forwarding can be drawn from this run. |
| Non-compliant Intune devices | Devices | Completed | 174 | 3 |
Findings
Applications with high-risk permissions 3
Critical Legacy Reporting Connector Application can escalate its own privileges
This application holds Directory.ReadWrite.All, AppRoleAssignment.ReadWrite.All as an application permission. Permissions in this group let the holder assign roles or credentials, so whoever controls this application's secret can make themselves a Global Administrator without ever signing in as a user. The application is published by another tenant, so the credential that uses this grant is held outside your organisation.
What to do Identify the workload behind this application and confirm it needs tenant-wide access. Where it does not, replace the grant with a narrower permission. Remove grants belonging to applications nobody can account for.
- Object type
- ServicePrincipal
- Object ID
- 00000000-0000-4000-c000-000000000201
- Category
- Applications
Evidence
{
"accountEnabled": true,
"escalationPermissions": [
"AppRoleAssignment.ReadWrite.All",
"Directory.ReadWrite.All"
],
"grantType": "Application permission (app role)",
"permissions": [
"AppRoleAssignment.ReadWrite.All",
"Directory.ReadWrite.All",
"User.Read.All"
],
"publishedExternally": true,
"resource": "Microsoft Graph"
}
High Invoice Archiver Application has tenant-wide access to organisation data
This application holds Mail.ReadWrite, Files.ReadWrite.All as an application permission. Application permissions are not scoped to a user and are not subject to MFA, so this grant covers every mailbox, site or file in the tenant, permanently.
What to do Scope mail and file access with an application access policy so the application only reaches the mailboxes it needs.
- Object type
- ServicePrincipal
- Object ID
- 00000000-0000-4000-c000-000000000202
- Category
- Applications
Evidence
{
"accountEnabled": true,
"bulkDataPermissions": [
"Files.ReadWrite.All",
"Mail.ReadWrite"
],
"grantType": "Application permission (app role)",
"permissions": [
"Files.ReadWrite.All",
"Mail.ReadWrite"
],
"publishedExternally": false,
"resource": "Microsoft Graph"
}
Medium Team Productivity Add-in Sensitive delegated permission granted for all users
An administrator consented to Files.Read.All, Sites.Read.All on Microsoft Graph for every user in the tenant. Any user of this application acts with these permissions without being asked, so the grant is only as trustworthy as the application itself.
What to do Confirm the application is one your organisation deliberately adopted. Where tenant-wide consent is not required, revoke it and restrict the app to an assigned group.
- Object type
- ServicePrincipal
- Object ID
- 00000000-0000-4000-c000-000000000203
- Category
- Applications
Evidence
{
"grantType": "Delegated permission (AllPrincipals)",
"resource": "Microsoft Graph",
"riskyScopes": [
"Files.Read.All",
"Sites.Read.All"
],
"scopes": [
"Files.Read.All",
"Sites.Read.All",
"User.Read",
"offline_access"
]
}
Privileged role assignments 4
Critical consultant_msp.example#EXT#@contoso.example Guest account holds the Global Administrator role
An account external to this tenant holds Global Administrator. Guest identities are governed by another organisation's password, MFA and offboarding processes, none of which this tenant controls.
What to do Remove the role from the guest account. Where an external party genuinely needs administrative access, issue them an internal account subject to this tenant's Conditional Access and lifecycle controls.
- Object type
- user
- Object ID
- 00000000-0000-4000-a000-000000000106
- Category
- Privileged access
Evidence
{
"accountEnabled": true,
"directoryScopeId": "/",
"principalType": "user",
"roleName": "Global Administrator",
"roleTier": "Tier0",
"userType": "Guest"
}
High Contoso Example Ltd 7 principals hold Global Administrator
Microsoft's guidance is to keep the number of permanent Global Administrators small -- commonly no more than 4. Every additional holder is another account whose compromise is a full tenant compromise.
What to do Move day-to-day work onto the least-privileged role that covers it, and make the remaining Global Administrator access eligible rather than permanent through Privileged Identity Management.
- Object type
- Tenant
- Object ID
- 00000000-0000-4000-b000-0000000000ff
- Category
- Privileged access
Evidence
{
"globalAdministratorCount": 7,
"holders": [
"Dana Whitfield",
"Petros Stavros",
"Rita Okonkwo (Partner)",
"break-glass-01",
"break-glass-02",
"IT Automation",
"Legacy Migration Account"
],
"threshold": 4
}
Medium j.laurent@contoso.example Disabled account still holds the Exchange Administrator role
The account is disabled but the Exchange Administrator assignment remains. Re-enabling the account -- during an offboarding reversal, a migration, or an attack -- restores administrative access with it.
What to do Remove role assignments as part of offboarding rather than relying on the account being disabled.
- Object type
- user
- Object ID
- 00000000-0000-4000-a000-000000000107
- Category
- Privileged access
Evidence
{
"accountEnabled": false,
"directoryScopeId": "/",
"principalType": "user",
"roleName": "Exchange Administrator",
"roleTier": "Tier1"
}
Informational break-glass-01@contoso.example Global Administrator assignment
break-glass-01@contoso.example holds Global Administrator. Entire directory.
What to do Confirm this assignment is still required and that the account is protected by phishing-resistant MFA.
- Object type
- user
- Object ID
- 00000000-0000-4000-a000-000000000108
- Category
- Privileged access
Evidence
{
"accountEnabled": true,
"directoryScopeId": "/",
"principalType": "user",
"roleName": "Global Administrator",
"roleTier": "Tier0",
"userType": "Member"
}
Users without MFA 3
Critical dana.whitfield@contoso.example Account is not capable of multi-factor authentication
The account has no registered multi-factor authentication method. This account holds at least one administrative role, so a single stolen password is enough to reach tenant administration.
What to do Require MFA registration through a Conditional Access policy, then confirm the user completes registration. For administrators, treat this as an immediate action.
- Object type
- User
- Object ID
- 00000000-0000-4000-a000-000000000101
- Category
- Identity
Evidence
{
"defaultMfaMethod": null,
"displayName": "Dana Whitfield",
"isAdmin": true,
"isMfaCapable": false,
"isMfaRegistered": false,
"lastUpdated": "2026-03-11T22:04:00Z",
"methodsRegistered": [],
"userType": "Member"
}
High operations.scanner@contoso.example Account is not capable of multi-factor authentication
The account has a registered method, but none of the registered methods can currently satisfy an MFA challenge.
What to do Require MFA registration through a Conditional Access policy, then confirm the user completes registration.
- Object type
- User
- Object ID
- 00000000-0000-4000-a000-000000000102
- Category
- Identity
Evidence
{
"defaultMfaMethod": "none",
"displayName": "Operations Scanner",
"isAdmin": false,
"isMfaCapable": false,
"isMfaRegistered": true,
"lastUpdated": "2025-08-02T11:19:00Z",
"methodsRegistered": [
"mobilePhone"
],
"userType": "Member"
}
Medium r.okonkwo_partner.example#EXT#@contoso.example Account is not capable of multi-factor authentication
The account has no registered multi-factor authentication method.
What to do Require MFA registration through a Conditional Access policy, then confirm the user completes registration.
- Object type
- User
- Object ID
- 00000000-0000-4000-a000-000000000103
- Category
- Identity
Evidence
{
"displayName": "Rita Okonkwo (Partner)",
"isAdmin": false,
"isMfaCapable": false,
"isMfaRegistered": false,
"methodsRegistered": [],
"userType": "Guest"
}
Inactive accounts 2
High p.stavros@contoso.example Enabled account is inactive
Last sign-in was 214 day(s) ago, beyond the 90 day threshold. The account also holds a privileged directory role, which makes a dormant account a standing administrative foothold.
What to do Confirm the account is still needed. If it is not, disable it, reclaim the licence, and delete it once the retention period allows.
- Object type
- User
- Object ID
- 00000000-0000-4000-a000-000000000104
- Category
- Identity
Evidence
{
"daysIdle": 214,
"displayName": "Petros Stavros",
"lastSignInUtc": "2025-08-12T07:55:00.0000000Z",
"licenseCount": 2,
"licensed": true,
"privileged": true,
"thresholdDays": 90,
"userType": "Member"
}
Medium temp.contractor03@contoso.example Enabled account has never signed in
No interactive sign-in has ever been recorded, and the account was created 402 day(s) ago.
What to do Confirm the account is still needed. If it is not, disable it and reclaim the licence.
- Object type
- User
- Object ID
- 00000000-0000-4000-a000-000000000105
- Category
- Identity
Evidence
{
"createdDateTime": "2025-02-05T14:00:00Z",
"daysIdle": 402,
"displayName": "Temporary Contractor 03",
"licenseCount": 1,
"licensed": true,
"privileged": false,
"thresholdDays": 90,
"userType": "Member"
}
Non-compliant Intune devices 3
High CTS-LAPTOP-0417 Device is non-compliant
The device failed the compliance policies targeting it. If a Conditional Access policy requires a compliant device, this device is being blocked; if no such policy exists, it is reaching corporate data while failing your own baseline.
What to do Open the device in Intune to see which settings failed, and fix the setting rather than the compliance policy.
- Object type
- Device
- Object ID
- 00000000-0000-4000-d000-000000000301
- Category
- Devices
Evidence
{
"assignedUser": "p.stavros@contoso.example",
"complianceState": "noncompliant",
"daysSinceSync": 2,
"isEncrypted": false,
"manufacturer": "Contoso Devices",
"model": "Pro 14",
"operatingSystem": "Windows",
"osVersion": "10.0.19045.4291"
}
Medium CTS-IPAD-0022 No compliance policy applies to this device
The device reports 'notApplicable', meaning no Intune compliance policy targets it. It will never be reported as non-compliant, because nothing is evaluating it -- and a Conditional Access policy requiring compliance may still let it through.
What to do Extend a compliance policy to cover this device's platform and group. Gaps in policy targeting are the most common reason a fleet looks compliant.
- Object type
- Device
- Object ID
- 00000000-0000-4000-d000-000000000302
- Category
- Devices
Evidence
{
"assignedUser": "dana.whitfield@contoso.example",
"complianceState": "notApplicable",
"daysSinceSync": 6,
"operatingSystem": "iOS",
"osVersion": "17.4.1"
}
Low CTS-DESKTOP-0090 Compliant verdict is stale
The device is recorded as compliant but last synchronised 118 day(s) ago, beyond the 30 day threshold. The verdict describes the device as it was then, not as it is now.
What to do Confirm the device is still in service. Retire records for devices that are gone so the compliance figures describe the real estate.
- Object type
- Device
- Object ID
- 00000000-0000-4000-d000-000000000303
- Category
- Devices
Evidence
{
"complianceState": "compliant",
"daysSinceSync": 118,
"isEncrypted": true,
"operatingSystem": "Windows",
"osVersion": "10.0.22631.3447"
}