How to read your posture report
What every part of the report is, where the numbers come from, why it names your own staff, and which parts you can trust without checking them yourself.
Open your assessment and check its progress
Open Guided setup and choose Start the assessment after connecting Microsoft 365. The page shows progress while your settings are read. A report can be ready or waiting for your answers; both states show the findings and checks that could not run. Waiting for answers is not an unfinished scan.
If an assessment fails or exceeds its time limit, read the explanation and check your Microsoft 365 connection before starting another assessment. An interrupted run is marked failed when its progress is next checked after the allowed run time. Its previous evidence and action records are retained. Do not treat a failed run or an empty findings list as a clean security result.
Your first posture report is not a list of recommendations. It is a description of your own organisation — with your colleagues' names in it — followed by a set of specific changes that are either already made, waiting for one tap, or waiting for a decision only you can take.
That makes it uncomfortable to read the first time. Most owners find at least one thing they did not know about their own business in the first two minutes. This article explains what each part of the report is, where its numbers come from, and which parts you can rely on without going and checking them in Microsoft 365 yourself.
The three things the report contains
The report is produced in three stages, and they have different reliability characteristics. It is worth knowing which stage you are reading at any moment.
- The inventory
- What we found: your users, your administrators, your applications and their permissions, your devices, your sign-in rules, your mailbox rules, your licences. Every object here was read from your tenant. Nothing in the inventory is inferred, estimated or generated.
- The assessment
- What the inventory means, judged against a versioned pack of checks. This report was produced by check pack
m365-2026.08.1, which contains 82 checks. Each check either produces a finding about named objects, produces nothing because your configuration is fine, or is marked skipped because it could not see the data it needs. - The change set
- The remediations the checks generated, sorted into three buckets: done, approve and decide. This is the part you act on. See Done, approve, decide for how the sorting works and why it is enforced in three separate places.
Where the numbers come from
Discovery is deterministic. It is not a language model, and it never has been. An inventory is a statement of fact about your business, and an invented asset in it would poison everything downstream — you would act on a machine that does not exist, and every other line in the report would deserve the same suspicion. So the code that builds the inventory reads your tenant and records what it read.
The assessment is the same: 82 deterministic checks, versioned as a pack, each one evaluating the inventory and either firing or not. The change set is typed and generated by the checks themselves — each check knows its own remediation. A change is a database row with a kind, typed parameters and named subjects, not a sentence somebody parsed.
The anatomy of a finding
Every finding is written in the same six parts, in the same order, so that after three of them you can skim. The order is deliberate: it puts the consequence before the mechanism, because you need to know whether to care before you need to know why.
The headline, with the number in it
One sentence stating the consequence in business terms and quantifying it. Not a label like "Privileged account hygiene" — a statement like "3 people can delete your entire Microsoft 365."
The names
The real people, applications, computers, mailbox rules or sign-in rules the finding is about. Up to six are named in full; beyond that you get the count and the first six, and the complete list is one click away.
What an attacker actually does with it
The concrete sequence, in one or two sentences. Not a threat category. This is the part that tells you whether the finding describes a real path into your business or a tidiness issue.
Why it matters here, and what the fix costs
The business reason, then the remediation with its price in time or money. Where a fix will break something, that sentence says so rather than leaving you to discover it.
What happens next
One sentence phrased by bucket. A done-bucket change reports what was already applied and how to reverse it. An approve-bucket change asks. A decide-bucket change poses a business question and waits.
The compliance note
The obligations this finding maps to, and the fact that your decision about it is recorded in your evidence bundle either way — including a decision to do nothing.
Here is a finding written out in full, so you can see the six parts in one piece of text. This is the register the whole report is written in.
3 people can delete your entire Microsoft 365 tenant, and two of them use those accounts for daily email. Anna, Marek and the admin@ shared account all hold Global Administrator. Anna and Marek also read email with these accounts. If either of them clicks a convincing phishing link, the attacker inherits the ability to delete every mailbox, disable every account, and turn off the logging that would show what happened. This is the single most common way small businesses are destroyed rather than merely robbed, and the fix takes about ten minutes: give Anna and Marek ordinary accounts for daily work, keep the admin accounts for admin only, and put a hardware-backed passkey on each. I can prepare the change; you approve it.Notice what that paragraph does not do. It does not say "40% of privileged accounts are dual-purpose". A percentage is easy to file away; two colleagues' names are not. It also states its own cost — about ten minutes per person — because a fix with an unstated price is a fix nobody schedules. That finding has its own article: Why we flag admin accounts used for daily email.
The four fields every check must carry
A check cannot exist in the pack without all four of these written out for a non-specialist reader. This is a build rule rather than an editorial aspiration: the pack does not compile if one is missing, so there is no such thing as a Qorionix finding that tells you something is wrong without telling you why it matters and what to do.
- Rationale
- Why this matters, in business terms. Written for someone who has never heard the phrase "Conditional Access".
- Attack
- What an attacker actually does with this weakness. Specific enough that you can judge whether it applies to you.
- Remediation
- The fix, and what it costs in time. "About two minutes per person" and "about ten minutes per person" are the kinds of numbers you will see, and where a fix will break something the field says which thing.
- Compliance
- The obligations the finding maps to — NIS2 articles, CIS Microsoft 365 benchmark items, ISO 27001 controls, DORA articles where relevant. This is what makes the report usable as audit evidence rather than only as a to-do list.
Why every finding names real objects
The named objects in a finding are called its subjects, and they are populated only from discovered inventory objects. That means every claim you read is re-resolvable against your own tenant: you can go and look.
There is a rule behind this that shapes the whole report. A finding with a blast radius above zero and no named subjects is rejected as a bug before it ever reaches you. A finding you cannot act on should not exist — if we cannot tell you which account, which application or which computer, we do not have a finding, we have an opinion.
The exceptions are findings that are genuinely about the whole tenant rather than about anybody in it — "nothing is keeping a record of what happens in your Microsoft 365", for instance. Those carry a single tenant-level subject and a blast radius of zero, and the report does not pretend to name a person.
Severity and blast radius are different things
Severity is how bad this kind of weakness is: critical, high, medium, low or info. Blast radius is how many people or systems a compromise — or a change — would affect. They are recorded separately because they answer different questions, and the report sorts by blast radius within a bucket so the widest-reaching items surface first.
A critical finding with a blast radius of one and a medium finding with a blast radius of everyone are not comparable on severity alone. Severity, blast radius, and what to fix first gives the order we would work in, with the reasoning for each position.
Skipped is not passed
Checks may be blocked by unavailable data, permissions, licensing, missing platform configuration, unsupported functionality, or an error. Those checks are reported as skipped, with the specific reason, and they are never reported as passed.
The three buckets at the bottom
Findings tell you what is true. The change set tells you what to do, sorted into three piles that read as three different conversations: things already done and reported after the fact, things waiting for one tap, and things that are a business trade-off we must not make for you.
The done pile is deliberately small and boring — logging, telemetry, inventory tagging, detections in shadow mode. Every multi-factor and Conditional Access change is deliberately excluded from it, because those alter how real people sign in. The full rules, the closed list of nine things we will ever do without asking, and the exact wording you will see next to each item are in Done, approve, decide.
The two questions we cannot answer for you
Two items in the decide pile are not findings at all. They do not depend on anything being wrong, and they appear on every report, because they are the only two facts about your business that discovery cannot establish.
- "Which two or three machines would stop the business if they went down?" — asset criticality. Until you answer, nothing is auto-isolatable, which is the safe default and also a slower one. A machine you have marked business-critical is never automatically disconnected regardless of any other setting.
- "If we spot something at 3am and cannot reach you, should we wait or act?" — your escalation preference, answered separately for each of ten classes of action, with a contact and a timeout. There are two honest answers and each has a real cost. Until you choose, we wait.
Both are phrased as business questions rather than technical ones, and both are recorded with who answered and when. You can change either at any time.
What to read first
If you have twenty minutes and the report in front of you, this order wastes the least of them.
- Read the critical findings, in order, and read the names in them. Do not skip to the fixes.
- Look at the done pile once, so you know what changed while you were reading. Nothing in it interrupts anybody, and every item can be reversed — see Undoing a change Qorionix made.
- Work the approve pile from the top. It is sorted worst-blast-radius-first on purpose.
- Answer the two questions above. They gate a lot of what the platform can do for you later.
- Read the coverage section last, and decide whether any skipped check is worth granting a permission or a licence for.