| Access Package Assignment Health | Entra ID | On demand |
| Access Review Health | Entra ID | Cached |
| Add-on Licences with No Product Sign-in (30 days) | Licensing | On demand |
| Admin Actions Outside Business Hours (7 days) | Compliance | Scan |
| AI Agent Identity Inventory | Entra ID | On demand |
| AI Agent Inventory | Tenant | On demand |
| All Devices | Entra ID | Cached |
| All Devices by User | Entra ID | Cached |
| All Distribution Lists | Exchange Online | On demand, PowerShell |
| All Document Libraries | SharePoint Online | On demand |
| All Dynamic Distribution Lists | Exchange Online | On demand, PowerShell |
| All Endpoint Security Policies | Intune | On demand |
| All Intune Apps | Intune | Cached |
| All Intune Apps for Android | Intune | Cached |
| All Intune Apps for iOS | Intune | Cached |
| All Intune Apps for Linux | Intune | Cached |
| All Intune Apps for MacOS | Intune | Cached |
| All Intune Apps for Windows | Intune | Cached |
| All Intune Devices | Intune | Cached |
| All Mail-Enabled Security Groups | Entra ID | On demand, PowerShell |
| All Mailboxes | Exchange Online | On demand, PowerShell |
| All Microsoft 365 Groups | Entra ID | On demand, PowerShell |
| Android Device Administrator Leftovers | Intune | Cached |
| App & Service Principal Credential Expiry | Entra ID | Cached |
| App Consent Policy Posture | Entra ID | Cached |
| App Credential Restriction Policies | Entra ID | On demand |
| App Provisioning (SCIM) Job Health | Entra ID | Cached |
| App Proxy Apps Published without Pre-authentication | Entra ID | On demand |
| App Registration Hygiene | Entra ID | Cached |
| Apple ADE Devices Never Enrolled | Intune | On demand |
| Apple MDM Certificate & Token Expiry | Intune | Cached |
| Application Proxy Connector Health | Entra ID | Cached |
| Apps with High-privilege Application Permissions | Entra ID | Cached |
| Audit Readiness | Compliance | On demand, PowerShell |
| Authentication Contexts - Are They Enforced? | Entra ID | On demand |
| Authentication Methods Policy Audit | Entra ID | Cached |
| Authentication Strengths - What They Really Allow | Entra ID | On demand |
| Auto Attendants & Call Queues Health | Teams and collaboration | On demand, PowerShell |
| Autopilot Deployment Time & Failures (30 days) | Intune | On demand |
| Azure Management Sign-ins after Mandatory MFA | Entra ID | On demand |
| Azure Subscription Owners & Root Elevation | Security | On demand |
| B2B Identity Providers & One-time Passcode | Entra ID | On demand |
| BitLocker Key & LAPS Password Retrieval Audit (30 days) | Entra ID | On demand |
| Bookings Pages Exposure | Tenant | On demand |
| Break-glass Account Health | Entra ID | Cached |
| Browser Extensions & Their Permissions | Security | On demand |
| CA Policies | Entra ID | Cached |
| Calendar & External Sharing Policy | Exchange Online | On demand, PowerShell |
| Calendar Folder Permissions | Exchange Online | Scan, PowerShell |
| Centrally Deployed Outlook Add-ins | Exchange Online | On demand, PowerShell |
| Certificate-based Authentication - Trusted CAs | Entra ID | On demand |
| Compliance Failures by Setting | Intune | Cached |
| Compliance Policy Strength | Intune | On demand |
| Conditional Access Blocks by App & Policy | Entra ID | Cached |
| Conditional Access Change History with Diff (30 days) | Entra ID | On demand |
| Conditional Access Coverage Gaps | Entra ID | Cached |
| Conditional Access Policy Gaps | Entra ID | Cached |
| Configuration Profile Deployment Errors | Intune | Cached |
| Contractors & Externals without an End Date | Entra ID | On demand |
| Copilot Agents & Apps Catalogue | Tenant | On demand |
| Copilot Licence Adoption | Licensing | Cached |
| Copilot Licence Candidates | Licensing | Cached |
| Copilot Oversharing - Sites Open to the Whole Company | SharePoint Online | Scan, PowerShell |
| Credentials Added to Microsoft First-party Apps | Entra ID | On demand |
| Cross-tenant Access & B2B Trust | Entra ID | Cached |
| Cross-tenant Synchronisation & Multi-tenant Organisation | Entra ID | On demand |
| Custom Roles & Administrative Units | Entra ID | Cached |
| Data Subject Requests Due (Priva) | Compliance | On demand |
| Days Since Last Password Reset for Users | Entra ID | Cached |
| Defender Alerts | Security | Cached |
| Defender Antivirus & ASR Exclusions | Intune | On demand |
| Defender Antivirus Health | Intune | Scan |
| Defender for Endpoint Onboarding Gaps | Security | On demand |
| Defender for Identity Sensor Health | Security | On demand |
| Delegated Mailbox Access | Exchange Online | Scan, PowerShell |
| Deleted Entra ID Users | Entra ID | On demand |
| Deleted Sites & Groups Nearing Permanent Purge | Entra ID | On demand, PowerShell |
| Device Encryption & TPM / Secure Boot Posture | Intune | Cached |
| Device Hardening Gaps (Secure Configuration Assessment) | Security | On demand |
| Device Naming & Category Compliance | Intune | On demand |
| Device Registration & Join Settings | Entra ID | On demand |
| Device Resource Pressure (CPU & Memory) | Intune | On demand |
| Devices Not Synced Recently | Intune | Cached |
| Devices Still Assigned to Leavers | Intune | Cached |
| Devices with uploaded Bitlocker Keys | Entra ID | On demand |
| Direct Send Exposure | Exchange Online | On demand, PowerShell |
| Directory Changes (last 30 days) | Entra ID | Cached |
| Directory Data Quality | Entra ID | Cached |
| Disabled Entra Devices - PREVIEW | Entra ID | Cached |
| Disabled Entra ID Users | Entra ID | Cached |
| Discovered Software & Outdated Apps | Intune | Cached |
| Distribution Lists Open to External Senders | Exchange Online | On demand, PowerShell |
| DLP Policy Inventory | Compliance | On demand, PowerShell |
| Domain Federation & Trust Audit | Entra ID | On demand |
| Duplicate Devices Entra ID - PREVIEW | Entra ID | Cached |
| Duplicate Devices Entra ID by Device Name - PREVIEW | Entra ID | Cached |
| Duplicate Devices Intune - PREVIEW | Intune | Cached |
| Dynamic Group Rule Health | Entra ID | Cached |
| E5 Value Realisation | Licensing | On demand |
| Email Authentication per Domain (SPF / DKIM / DMARC) | Exchange Online | On demand, PowerShell |
| Emails With Large Attachments (over 10 MB) - PREVIEW | Exchange Online | On demand |
| Empty Entra ID Groups | Entra ID | Cached |
| Empty Mailboxes | Exchange Online | On demand, PowerShell |
| Endpoint Privilege Management Elevations (30 days) | Intune | On demand |
| Endpoint Security Policy Posture | Intune | On demand |
| Enrolment Failures (30 days) | Intune | Cached |
| Enterprise Apps Open to Every User | Entra ID | On demand |
| Entra ID Failed Authentication Attempts | Entra ID | On demand, PowerShell |
| Entra ID Groups | Entra ID | Cached |
| Entra ID Groups Containing Guests | Entra ID | Cached |
| Entra ID Groups Hidden From Address Book | Exchange Online | On demand, PowerShell |
| Entra ID Groups Licence Statistics | Entra ID | On demand, PowerShell |
| Entra ID Groups with Disabled Members | Entra ID | Cached |
| Entra ID Groups with Left / Expired Members | Entra ID | Cached |
| Entra ID Groups with Licences | Entra ID | On demand, PowerShell |
| Entra ID Groups with Licences containing disabled products (plans) | Entra ID | On demand, PowerShell |
| Entra ID Groups with Licensing Issues | Entra ID | On demand, PowerShell |
| Entra ID Groups Without Owners | Entra ID | On demand |
| Entra ID Guest Users | Entra ID | Cached |
| Entra ID P1 / P2 Licence Compliance | Licensing | Cached |
| Entra ID Roles | Entra ID | Cached |
| Entra ID Roles - Privileged Role Members | Entra ID | On demand, PowerShell |
| Entra ID Users | Entra ID | Cached |
| Entra ID Users With OnPremises Provisioning Errors | Entra ID | Cached |
| Entra ID Users with past Employee Leave DateTime Attribute | Entra ID | Cached |
| Entra ID Users Without Location | Entra ID | Cached |
| Entra User Licence Assignment Direct vs. Inherited | Entra ID | On demand, PowerShell |
| EOP & Defender for Office 365 Posture | Exchange Online | On demand, PowerShell |
| EWS Retirement Readiness | Exchange Online | On demand, PowerShell |
| Exchange ActiveSync Device Partnerships | Exchange Online | Scan, PowerShell |
| Exchange Admin Role Groups & High-risk Roles | Exchange Online | On demand, PowerShell |
| Exchange Online Transport Rules With External Recipients | Exchange Online | On demand, PowerShell |
| Expiring Entra ID Groups (90 Days) | Entra ID | On demand, PowerShell |
| Exposed Devices & Exploitable Vulnerabilities | Security | On demand |
| External Forwarding Rules On Mailbox Level | Exchange Online | On demand, PowerShell |
| External Sender Tagging | Exchange Online | On demand, PowerShell |
| Failing App Sign-ins | Entra ID | Cached |
| Frontline Licence Entitlement Breaches | Licensing | On demand |
| Full Mailboxes | Exchange Online | On demand, PowerShell |
| Global Secure Access Health | Security | On demand |
| Group & Teams Sprawl Trend | Tenant | Cached |
| Group Usage Finder - Is This Group Used Anywhere? | Entra ID | Scan |
| Guest Domains & Pending Invitations | Entra ID | Cached |
| Guest Lifecycle | Entra ID | Cached |
| Guest Sign-ins by Home Tenant | Entra ID | Cached |
| Guest Sponsorship Coverage | Entra ID | Cached |
| Guests with Elevated Access | Entra ID | Cached |
| Hybrid Sync Health | Entra ID | Cached |
| Inactive & Soft-deleted Mailboxes | Exchange Online | On demand, PowerShell |
| Inactive Devices (90 days) | Entra ID | Cached |
| Inactive Distribution Groups (last 10 days) | Exchange Online | On demand, PowerShell |
| Inactive Enterprise Apps & Stale Service Principals | Entra ID | Cached |
| Inactive Entra ID Users | Entra ID | Cached |
| Inactive SharePoint Sites (90 days) | SharePoint Online | On demand, PowerShell |
| Inactive SharePoint Users (90 days) | SharePoint Online | Scan |
| Intune Admin Activity (30 days) | Intune | Cached |
| Intune Assignment Hygiene | Intune | On demand |
| Intune Compliance Posture | Intune | Cached |
| Intune Connector & Integration Health | Intune | On demand |
| Intune Device Certificates Expiring | Intune | Scan |
| Intune Devices - Android | Intune | Cached |
| Intune Devices - iOS | Intune | Cached |
| Intune Devices - Linux | Intune | Cached |
| Intune Devices - macOS | Intune | Cached |
| Intune Devices - Windows | Intune | Cached |
| Intune Licence Compliance | Licensing | Cached |
| Intune Multi Admin Approval Coverage | Intune | On demand |
| Intune Primary User Mismatch (Windows) | Intune | On demand |
| Intune RBAC & Scope | Intune | Cached |
| Intune Tenant Hygiene | Intune | Cached |
| Jailbroken, Rooted & Threat-flagged Devices | Intune | Cached |
| Joiners & Leavers Trend (12 months) | Entra ID | On demand |
| Journal Rules & Archive Destinations | Exchange Online | On demand, PowerShell |
| Laptop Battery Health | Intune | On demand |
| Leaver Clean-up Completeness | Entra ID | Cached |
| Legacy Protocols & SMTP AUTH Exposure | Exchange Online | On demand, PowerShell |
| Licence Reclamation Candidates | Licensing | Cached |
| Licence vs Actual Service Usage | Licensing | Cached |
| Licences | Licensing | Cached |
| Lifecycle Workflow Failures (30 days) | Entra ID | On demand |
| Litigation Hold & Retention Coverage | Compliance | On demand, PowerShell |
| Local Administrator Assignments via Intune | Intune | On demand |
| Low Disk Space & Hardware Age | Intune | Cached |
| Mail Contacts Hygiene | Exchange Online | On demand, PowerShell |
| Mail Filtering Bypasses | Exchange Online | On demand, PowerShell |
| Mailbox Folder Permissions (non-calendar) | Exchange Online | Scan, PowerShell |
| Mailbox-reading Apps Not Scoped to Specific Mailboxes | Exchange Online | On demand, PowerShell |
| Malicious-link Clicks & Mail ZAP Did Not Remove (30 days) | Security | On demand |
| Manager Chain Integrity | Entra ID | On demand |
| Mass Download & Deletion Activity (7 days) | Compliance | Scan |
| Match Devices From Entra to Intune to Autopilot | Intune | Cached |
| Meeting Room Utilisation (30 days) | Tenant | Scan |
| Message Centre | Tenant | Cached |
| MFA & Passwordless Coverage | Entra ID | Cached |
| MFA Fatigue & Repeated MFA Denials | Entra ID | Cached |
| Microsoft 365 Adoption by Department | Licensing | Cached |
| Microsoft 365 Apps Activations & Desktop Right-sizing | Licensing | On demand |
| Microsoft 365 Backup Coverage | Compliance | On demand |
| Microsoft 365 Group Governance Settings | Entra ID | Cached |
| Microsoft Entra Recommendations | Entra ID | Cached |
| Microsoft Tunnel Gateway Health | Intune | On demand |
| Mobile App Protection Coverage | Intune | Cached |
| Movers: Access Kept after a Department Change | Entra ID | On demand |
| MTA-STS, TLS-RPT & SMTP DANE per Domain | Exchange Online | On demand, PowerShell |
| Multi-geo Data Location | Entra ID | On demand |
| Named Locations & Trusted IP Audit | Entra ID | Cached |
| New-starter Onboarding Completeness | Entra ID | Cached |
| OAuth Consent Grants | Entra ID | Cached |
| OneDrive List | OneDrive | On demand, PowerShell |
| Open eDiscovery Cases & Legal Holds | Compliance | Cached |
| Orphaned OneDrives of Leavers | OneDrive | On demand, PowerShell |
| OS Version Spread & End-of-Support Exposure | Intune | Cached |
| Outlook on the Web Mailbox Policies | Exchange Online | On demand, PowerShell |
| Outlook Rules With External Recipients | Exchange Online | Scan, PowerShell |
| Overlapping & Duplicate Licence Assignments | Licensing | Cached |
| Partner (CSP / GDAP) Admin Sign-ins (30 days) | Entra ID | On demand |
| Password Protection & Smart Lockout Settings | Entra ID | On demand |
| Pending Admin Consent Requests | Entra ID | Cached |
| Pending Guest Invitations | Entra ID | Cached |
| Per-user Licence Assignment Errors | Licensing | Cached |
| Phishing Simulation Results | Security | Cached |
| Phishing-resistant MFA for Admins | Entra ID | Cached |
| Phone Numbers Shared Across MFA Registrations | Entra ID | Scan |
| PIM Activation Patterns (30 days) | Entra ID | On demand |
| PIM for Groups - Standing & Eligible Access | Entra ID | Scan |
| PIM Role Settings Audit | Entra ID | On demand |
| Policy Deployment Status | Intune | On demand |
| Power Platform: Orphaned Flows & Apps, DLP Gaps | Tenant | On demand |
| Priority Accounts & Most-targeted Users | Exchange Online | On demand, PowerShell |
| Privilege Escalation through App Ownership | Entra ID | On demand |
| PSTN Usage & Direct Routing Failures (30 days) | Teams and collaboration | On demand |
| Public Folder Exposure | Exchange Online | Scan, PowerShell |
| Published Calendars | Exchange Online | Scan, PowerShell |
| Quarantine Backlog & Release Requests (30 days) | Exchange Online | On demand, PowerShell |
| Recently Modified SharePoint Files (search: ‘Documents’) | SharePoint Online | On demand |
| Remediation & Platform Script Failures | Intune | Cached |
| Remote Domain Settings | Exchange Online | On demand, PowerShell |
| Removable Storage (USB) Activity (30 days) | Security | On demand |
| Retired InfoPath Forms Still Present | SharePoint Online | Scan, PowerShell |
| Risk Detections | Entra ID | Cached |
| Risky Users & Risk Detections | Entra ID | Cached |
| Risky Workload Identities | Entra ID | Cached |
| Role Assignments Made Outside PIM | Entra ID | Cached |
| Role-assignable Group Changes | Entra ID | Cached |
| Role-assignable Group Membership & Changes | Entra ID | Cached |
| Room & Resource Mailbox Configuration | Exchange Online | On demand, PowerShell |
| SaaS App Usage & Seat True-up (7 days) | Licensing | On demand |
| Secure Boot Certificate Update Readiness | Intune | On demand |
| Secure Score & Top Improvement Actions | Security | Cached |
| Security Alerts & Incidents | Security | Cached |
| Security Defaults & Per-user MFA Leftovers | Entra ID | Scan |
| Security Key & Passkey Inventory | Entra ID | Scan |
| Security-info Changes & Temporary Access Passes | Entra ID | Cached |
| Self-service & Trial Purchases | Licensing | Cached |
| Self-service Password Reset Gaps | Entra ID | Cached |
| Sensitivity Label & Auto-labelling Policies | Compliance | On demand, PowerShell |
| Sensitivity Label Coverage of Groups & Sites | Compliance | On demand, PowerShell |
| Service Accounts Disguised as Users | Entra ID | Cached |
| Service Health & Message Centre | Tenant | Cached |
| Service Status | Tenant | Cached |
| Shadow SaaS from Defender for Cloud Apps (30 days) | Security | On demand |
| Shared & Resource Mailboxes With Sign-in Enabled | Exchange Online | On demand, PowerShell |
| Shared Channels with External Members | Teams and collaboration | Scan |
| Shared Mailboxes Needing a Licence | Exchange Online | On demand, PowerShell |
| Shared Mailboxes Nobody Can Access | Exchange Online | Scan, PowerShell |
| SharePoint & OneDrive Sharing Posture | SharePoint Online | On demand, PowerShell |
| SharePoint Embedded & Loop Containers | SharePoint Online | On demand, PowerShell |
| SharePoint Version-history Storage | SharePoint Online | Scan, PowerShell |
| Sign-ins from Unmanaged & Non-compliant Devices | Entra ID | Cached |
| Sign-ins from Unusual Countries & Device-code Flow | Entra ID | Cached |
| Single-factor Interactive Sign-ins (7 days) | Entra ID | On demand |
| Site Collection Administrators Sprawl | SharePoint Online | Scan, PowerShell |
| Sites Allowing Custom Scripts | SharePoint Online | On demand, PowerShell |
| Sites List | SharePoint Online | On demand, PowerShell |
| Sites Without an Active Owner | SharePoint Online | On demand, PowerShell |
| Smart Lockout & Password-spray Indicators | Entra ID | Cached |
| SMS / Voice MFA Retirement Exposure | Entra ID | Cached |
| SPFx Solutions & Tenant-wide API Permissions | SharePoint Online | On demand, PowerShell |
| Stale Administrators | Entra ID | Cached |
| Standing vs Just-in-time Admin Access | Entra ID | Cached |
| Startup Performance & App Reliability | Intune | Cached |
| Storage Growth & Quota Risk | Tenant | Cached |
| Stuck Mailbox Migrations & Move Requests | Exchange Online | On demand, PowerShell |
| Stuck Remote Actions (wipe, retire, lock) | Intune | On demand |
| Subscription Renewal & Trial Calendar | Licensing | Cached |
| Suspicious Inbox Rules | Exchange Online | Scan, PowerShell |
| Synced & Everyday Accounts Holding Admin Roles | Entra ID | Cached |
| Teams App Inventory | Teams and collaboration | Scan |
| Teams External Access & Federation | Teams and collaboration | On demand, PowerShell |
| Teams Inventory - Ownerless & Inactive Teams | Teams and collaboration | Cached |
| Teams Meeting & Guest Policy Audit | Teams and collaboration | On demand, PowerShell |
| Teams Phone Emergency Address Compliance | Teams and collaboration | On demand, PowerShell |
| Teams Phone Numbers & Calling Licence Usage | Teams and collaboration | On demand, PowerShell |
| Teams Rooms & Teams Devices Health | Teams and collaboration | On demand |
| Tenant Configuration Drift | Security | On demand |
| Terms of Use Acceptance | Entra ID | On demand |
| Token Lifetime, Home Realm Discovery & Claims-mapping Policies | Entra ID | On demand |
| TPM / Secure Boot Hardware Scan | Intune | Scan |
| Transport Rule & Connector Inventory | Exchange Online | On demand, PowerShell |
| Unassigned & Superseded Intune Apps | Intune | On demand |
| Unassigned Licences | Licensing | Cached |
| Unlicensed Users | Entra ID | Cached |
| Unsupervised iOS / iPadOS Devices | Intune | Cached |
| Unused Delegated Consents | Entra ID | Cached |
| Unused Mailboxes | Exchange Online | On demand, PowerShell |
| UPN, E-mail & Proxy Address Mismatches | Entra ID | On demand |
| User Access 360 | Entra ID | On demand, PowerShell |
| User Excessive Group Membership (10) | Entra ID | On demand |
| User-reported Phishing Backlog | Exchange Online | On demand, PowerShell |
| Users by Device | Entra ID | Cached |
| Users Restricted from Sending | Exchange Online | On demand, PowerShell |
| Windows 11 Hardware Readiness | Intune | Cached |
| Windows 365 Cloud PC Inventory | Intune | Cached |
| Windows 365 Connection Quality (7 days) | Intune | Scan |
| Windows Known Issues Affecting Our Builds | Intune | Cached |
| Windows LAPS & BitLocker Escrow Gaps | Intune | Cached |
| Windows Patch Level | Intune | Cached |
| Windows Update Compliance | Intune | Cached |
| Workload Identity Federation Trusts | Entra ID | On demand |
