How GraphSec decides whether a Microsoft 365 control passed, needs attention or could not be tested.

GraphSec reviews specific settings and states in a Microsoft 365 tenant.

Each control answers one administrative question, such as whether privileged accounts are covered by an effective Conditional Access policy, whether anonymous SharePoint links are allowed or whether privileged roles have accountable owners.

The result applies to the time of the scan and the data that could be read. Missing licences, permissions or APIs are reported as testing gaps, not as passed controls.

The 53 controls follow the main work areas of a Microsoft 365 administrator.

The catalog covers identities, apps and OAuth, users and guests, devices, Exchange and collaboration, data governance, detection and recovery.

Every control follows the same sequence.

1. 1
   Check prerequisites

   Confirm applicability, licensing, module availability and read permissions.

2. 2
   Read data

   Collect the required values from the defined source.

3. 3
   Apply the rule

   Compare the values with the documented expected and deviation criteria.

4. 4
   Document the result

   Store status, reason, evidence, recommendation and testing limitations.

The status describes the technical result.

The score evaluates results. Coverage shows how much could be assessed.

Passed counts as 1, Warning as 0.5 and Failed as 0. Controls without sufficient data are not counted positively.

The report shows why a control received its status.

Evidence may include policies, exclusions, role assignments, sharing settings or device state. Restore tests, contracts and management approval must be supplied separately.

Mapping explains relevance; it does not prove full compliance.

A technical result can support areas such as access control, logging, supply-chain security or recovery. Full compliance also requires governance, contracts, processes and effectiveness evidence.

The user remains responsible for validation, prioritisation and customer communication.

• Microsoft APIs and licensing can change.
• Read permissions must follow least privilege.
• A configured policy does not automatically prove organisational effectiveness.
• On-premises systems and unconnected services remain outside the scan.
• The report is not legal advice, a certification or a complete compliance assessment.

Read the full disclaimer