The Getting started checklist, and why a tick can disappear
The four-step checklist never stores whether a step is done. It re-derives every tick from evidence on each page load, so a tick that vanishes is telling you something true.
Getting started is the first thing in the navigation and the first page you see. It is four steps, and it works differently from every other onboarding checklist you have used, in a way that is worth two minutes of explanation because otherwise it looks like a bug.
The design note behind that puts it more sharply than we would in marketing copy: a ticked box for a connector that failed is the same class of lie as a data-erasure request that deletes nothing. So the schema has nowhere to write the lie, and there is no route that would accept one.
The four steps, and what each one is checked against
| Step | What is actually queried | Typical time |
|---|---|---|
| 1. Connect Microsoft 365 | An integration instance exists and a stored credential exists for it. Both, so a half-finished consent does not count. | 10 minutes |
| 2. Install the sensor on one computer | A sensor row that is not revoked and has actually checked in — recently, within twenty-four hours, or at least once. | 10 minutes |
| 3. Read your posture report | An assessment run exists. | 5 minutes |
| 4. Decide one thing | A change with the state accepted or rejected. See below — this one has a deliberate subtlety. | 5 minutes |
Step two's evidence is the one to notice. A sensor row on its own only proves that an enrolment token was spent; what proves an agent is alive is a check-in. So a machine where the installer ran and the service never started reports the step as outstanding, and tells you the enrolment date, rather than ticking on the strength of a row existing. That is the difference between installed and working, and it is the distinction the whole product is built around.
The six states a step can be in
- `ready`
- Nothing is stopping you. Start here.
- `blocked`
- It depends on an earlier step. Step three needs step one, and step four needs step three — there is no posture report to read before something has been connected, and nothing to decide before there is a report.
- `in_progress`
- Partial evidence exists. A sensor enrolled and not yet checking in lands here.
- `verified`
- The evidence query found what it was looking for. This is the tick.
- `skipped`
- You chose to skip it. Reversible — see below.
- `attention`
- Something needs looking at rather than doing for the first time.
Step two runs in parallel — it does not depend on anything, so you can install a sensor before or while connecting Microsoft 365. If you have two people, that is the obvious split.
Skipping, un-skipping and dismissing
All four steps are skippable, and the skip is reversible. Skipping is honest bookkeeping rather than a shortcut: it records that you chose not to do this, and it does not pretend the step is complete. A skipped step still shows as skipped and not as verified.
Dismissing hides the whole checklist, and resuming brings it back. Progress is per tenant rather than per browser, so a colleague picking up where you left off sees the same state, and clearing your cookies loses nothing. The only per-person setting on this surface is a view preference.
Reading the checklist needs integration:instances.read, which the viewer and member roles hold. Skipping, un-skipping and dismissing need integration:instances.write, which is administrator-only. So a team member can see where you are; only an administrator can change it.
Each step tells you what it will not do
Every step carries three pieces of prose besides its title: what it will do, what it will not do, and how to reverse it. That middle one is unusual in onboarding copy and it is the most valuable part of the page. Two examples, quoted:
Make you protected, monitored or compliant. Connecting this means we can now tell you what we found. It is not a security outcome.
Grant anybody privileged access on its own. Ever.
Read those before you read the will do lists. A checklist that only tells you what a step achieves is how somebody finishes onboarding believing they are protected, and the honest version of step one is that connecting Microsoft 365 buys you visibility and nothing else until you act on what it shows.
Two things that will look wrong and are not
A tick that was there yesterday and is not there today
Something changed in the underlying state. The connection was removed or its credential expired; the sensor stopped checking in; the decision you made was reverted. The checklist is not forgetting — it is re-reading. Follow the step's own hint, which will name what it looked for and did not find.
Step three or four locked when you believe you have done the work
They are
blockedon a prerequisite, and the prerequisite is evaluated by evidence too. If step one is not verified — even if you connected Microsoft 365 and something has since gone wrong with the credential — step three stays blocked. Fix step one and step three unlocks on the next page load, with no action needed on step three itself.
What to do next
- Do step two now if you have not — it is independent of everything else and it takes ten minutes. Installing the sensor on Windows.
- Connect Microsoft 365 — step one, with every permission we ask for and why.
- Done, approve, decide — what step four is actually asking you to do.
- The first-week checklist — the list that follows this one.