Understanding Results

After running a compliance assessment, you'll receive detailed results showing your security posture. Learn how to interpret and act on this information.

Results Overview

Summary Dashboard

The results summary provides a quick overview:

Score Interpretation

Your compliance score indicates your security posture:

Control Statuses

Passed

Controls with Passed status meet the security requirements:

• Configuration matches expected value
• All conditions satisfied
• Evidence confirms compliance

Example: "MFA is enabled for all administrators" - Conditional Access policy exists and is enforced.

Failed

Controls with Failed status don't meet requirements:

• Configuration differs from expected value
• One or more conditions not satisfied
• Evidence shows non-compliance

Example: "Legacy authentication is blocked" - Legacy authentication protocols are still allowed.

Manual Review

Controls requiring Manual Review need human verification:

• Automated assessment isn't possible
• Policy exists but effectiveness can't be verified
• Requires review of documentation or processes

Example: "Security awareness training is conducted" - Cannot verify training completion via API.

Not Applicable

Controls marked Not Applicable don't apply to your environment:

• Feature isn't used in your tenant
• License doesn't include the capability
• Organizational exception documented

Example: "SharePoint external sharing is restricted" - SharePoint isn't deployed.

Error

Controls with Error status couldn't be evaluated:

• API call failed
• Permission denied
• Data unavailable

Example: Assessment couldn't read Conditional Access policies due to permission issues.

Control Details

Viewing Control Details

Click on any control to see:

1. Description - What the control requires
2. Rationale - Why it's important
3. Status - Current evaluation result
4. Evidence - Data collected during assessment
5. Remediation - Steps to fix (if failed)

Evidence

Evidence shows the actual data evaluated:

{
  "conditionalAccessPolicies": [
    {
      "displayName": "Require MFA for admins",
      "state": "enabled",
      "conditions": {
        "users": {
          "includeRoles": ["Global Administrator", "Security Administrator"]
        }
      }
    }
  ]
}

Evidence helps you:

• Understand why a control passed or failed
• Provide audit documentation
• Verify the assessment logic

Remediation Guidance

For failed controls, guidance includes:

• Steps - Specific actions to remediate
• Console Location - Where to make changes in admin portals
• PowerShell - Commands to implement fixes
• Documentation - Links to Microsoft documentation

Filtering and Sorting

Filter Options

Narrow results using filters:

Sort Options

Order results by:

• Severity (default) - Critical first
• Status - Failed first
• Theme - Grouped by category
• Name - Alphabetical

Example: Priority View

To focus on what matters most:

1. Filter to Failed status
2. Filter to Critical and High severity
3. Sort by Severity descending

This shows your most important gaps first.

Comparing Results

Comparison View

Compare current results with previous assessments:

1. Select current assessment
2. Click Compare
3. Select previous assessment
4. View differences

Change Indicators

Trend Analysis

View compliance trends over time:

• Score Graph - Compliance score over multiple assessments
• Control Trends - Individual control status changes
• Theme Progress - Improvement by control category

Exporting Results

Export Options

Export results in various formats:

What's Included

Exports contain:

• Assessment metadata (date, framework, scope)
• Summary statistics
• Control details with status
• Evidence (configurable)
• Remediation guidance

Taking Action

Prioritization Framework

Prioritize remediation using:

1. Severity - Critical and high first
2. Effort - Quick wins vs. complex changes
3. Impact - Controls affecting many users
4. Dependencies - Controls that enable others

Creating a Remediation Plan

1. Filter to failed critical/high controls
2. Review remediation steps for each
3. Estimate effort and assign owners
4. Set target dates for completion
5. Re-run assessment after remediation

Documenting Exceptions

For controls you won't remediate:

1. Go to the control details
2. Click Add Exception
3. Provide justification
4. Set review date
5. Controls with exceptions show as "Excluded"

What's Next?

• Assessment History - Track compliance over time
• Generating Reports - Create formal documentation
• Evidence Collection - Manage compliance evidence